ContextualWisdomLab · seonghobae · Sep 6, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -28,7 +28,9 @@ Routes have different meanings: `/health` is liveness, `/ready` is offline confi
 
 This revision exposes both `ALLOWED_WORKFLOW_REF_PREFIX` and `ALLOWED_WORKFLOW_SHA`. Despite the legacy ref-binding name, `src/worker.ts` parses `ALLOWED_WORKFLOW_REF_PREFIX` as one **exact full workflow ref** and compares decoded `job_workflow_ref` or `workflow_ref` for exact equality. Wildcard, comma, whitespace, and prefix-sharing configuration forms are rejected. `src/runtime-entrypoint.ts` performs readiness dispatch and delegates `/exchange`; `src/entrypoint.ts` applies the distributed rate limiter before `src/worker.ts` performs its denial-only exact workflow-ref precheck. `src/index.ts` independently enforces the exact workflow ref/repository plus immutable `job_workflow_sha` or fallback `workflow_sha` after cryptographic verification. Missing, malformed, mismatched, or non-canonical configured source identity fails closed.
 
-`wrangler.toml` pins `ALLOWED_WORKFLOW_SHA` to protected central `.github` commit `1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5`. The exact trusted `.github/workflows/noema-review.yml` blob at that protected commit remains Git blob `064c4e5aeedcbb188196bd4800a0b918abd6da27`. Movement from `c8cc68a34bd19a91e2544acf08f2ead142ba702b` to current `1cbb6a...` leaves the workflow bytes unchanged but modifies the materialized trusted source tree in `scripts/ci/noema_review_gate.py` and its focused tests, adding one bounded correction attempt when the trusted verdict validator rejects an invalid changed-line/adversarial verdict. Because `noema-review.yml` materializes the complete trusted central source tree at its immutable workflow SHA and then executes `python3 -m scripts.ci.noema_review_gate`, this source-tree change is trust-relevant even though the workflow blob is unchanged; Noema re-audited the exact protected one-commit delta before accepting the new repository commit identity. More generally, Noema re-audits both the exact workflow blob and every relevant protected central delta before each repository-commit movement; ancestry alone is insufficient because GitHub OIDC `job_workflow_sha` binds the caller to that exact repository commit identity. The central repository remains a read-only dependency from Noema. The protected central OIDC consumer still reads a top-level `.token` from the exchange response while Noema's stable success envelope exposes the credential under `data.token`; that consumer defect remains central-owned and is not repaired by weakening or reshaping Noema's stable envelope.
+`wrangler.toml` is the canonical repository copy of the currently audited `ALLOWED_WORKFLOW_SHA`; this architecture document deliberately does not duplicate that mutable 40-character value. GitHub OIDC `job_workflow_sha` binds the caller to the exact protected central `.github` repository commit selected by `refs/heads/main`, not merely to the bytes of one workflow file. Therefore every protected central ref movement requires a fresh comparison before Noema may move the runtime trust pin, even when the intervening commit changes only unrelated files. The audit must compare the new protected source tip, the trusted `noema-review.yml` workflow, the review-gate implementation it invokes, central Security Scan authority, and the intervening source-tree delta. Audit-specific SHAs and file deltas belong in the active PR/review evidence rather than this canonical architecture document so later unrelated central commits cannot silently make architecture prose stale. The current central Noema workflow must continue to resolve its trusted source to an immutable workflow commit before materialization, reject stale pull-request heads before credential/model setup, and keep model evaluation separate from publication. Noema advances or rolls back its repository-commit trust pin only after those checks succeed.
+
+The central repository remains a read-only dependency from Noema. A central OIDC consumer mismatch, reviewer-token lifecycle defect, or scanner-control defect remains central-owned: Noema does not weaken or reshape its producer envelope, reviewer boundary, or source-authentication semantics to compensate for a foreign consumer/control-plane defect.
 
 The configured workflow ref and source SHA are operator authority bytes, not normalization input. The protected workflow-ref parser and authoritative verifier do not trim whitespace from these trust values before validation/comparison. A whitespace-bearing value therefore fails as unusable configuration rather than being normalized into a different trusted identity. On an active PR head this statement is candidate truth if the corresponding source delta is not yet on the live protected base.
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,9 @@
 # Changelog
 
 ## Unreleased
+- 중앙 `.github` protected `main`이 `b4eec000d21084accb736d289eb64cfd78e7a91a`에서 `78271917b526469c559fa75cb5ee39426e5494d1`로 이동함에 따라 `ALLOWED_WORKFLOW_SHA` immutable OIDC 신뢰 pin을 재감사·갱신한다. 두 revision의 `.github/workflows/noema-review.yml` Git blob은 동일(`30c9e9a5173215aa685bc154db01e5988219aae5`)하고, 개재된 5개 protected commit은 dependency-review 통합, OpenCode superseded-poll 종료 처리, 완료된 source-fix workflow/script 정리만 변경한다. 워크플로 bytes가 같아도 GitHub OIDC `job_workflow_sha`는 정확한 repository commit identity에 결합되므로 runtime trust pin은 현재 protected source commit으로 이동한다.
+- 중앙 `.github` protected `main`이 `a819919d8bd9bc4215fee1c65f39f0aef1df9234`에서 `6f70174e338013fec9a000311bc72312f5d4dbf9`로 다시 이동함에 따라 `ALLOWED_WORKFLOW_SHA` immutable OIDC 신뢰 pin을 재차 갱신한다. 두 커밋 사이에서 신뢰된 `noema-review.yml` 워크플로 blob은 동일(`2c941983f9d846415387816c0d5ce5326bfc10ef`)했고, 개재된 4개 커밋은 `pr-review-merge-scheduler.yml`과 `opencode-review.yml`만 변경했으며 noema-review.yml이 이들을 `uses:`로 참조하지도 않으므로 Noema의 OIDC 신뢰 경계에는 영향이 없음을 확인한 뒤 pin을 이동했다.
+- 중앙 `.github` protected `main`이 `1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5`에서 `a819919d8bd9bc4215fee1c65f39f0aef1df9234`로 이동함에 따라 `ALLOWED_WORKFLOW_SHA` immutable OIDC 신뢰 pin을 갱신한다. 신뢰된 `noema-review.yml` 워크플로 blob 자체는 변경되지 않았지만 GitHub `job_workflow_sha`는 정확한 저장소 커밋에 결합되므로, 중앙 소스 트리 변경이 있을 때마다 이 pin도 재감사·이동해야 한다. `ARCHITECTURE.md`는 이 휘발성 40자 값을 문서에 중복 기재하지 않고 `wrangler.toml`을 canonical 저장소 사본으로 명시하도록 갱신했으며, 배포된 `NoemaRateLimiter`/`NoemaOidcReplayGuard` SQLite Durable Object 선언을 새 migration으로 재선언하지 않는 회귀 테스트를 추가했다.
 - Noema의 필수 PR 워크플로 `ci`, `reviewer-ci`, `patch-validator-image`를 부동 `ubuntu-latest` 대신 명시적 `ubuntu-24.04` GitHub-hosted runner에 고정하고, 인용 여부와 무관하게 `ubuntu-latest` 회귀를 탐지하는 계약 테스트를 추가해 pre-checkout runner-assignment stall의 repository-owned selector 원인을 제거한다. 중앙 `Security Scan`의 runner/control-plane 권한은 별도 `.github` owner 경계에 유지한다.
 - 비공개 취약점 보고 감사가 16 KiB 응답 상한, bounded stream 취소, canonical repository/source identity의 독립 검증, SHA-1/SHA-256 exact revision, symlink·retained-path 보호를 실패-폐쇄로 강제한다. 이 감사 결과는 live private reporting 활성화, notification staffing, 실제 advisory 대응 또는 release/deployment 완료 증거를 대신하지 않는다.
 - External scheduler evidence audits now retain source authority through final report publication: reports are owner-only, no-follow, exclusive one-shot receipts, so a concurrent rename cannot move the accepted source inode onto the report pathname and have it replaced. Source/report path and inode alias checks, single-link retained-source validation, and Unicode control sanitization remain fail closed.
@@ -46,7 +49,7 @@
 - credential-bearing GitHub App REST 요청의 egress를 exact `https://api.github.com` origin으로 고정. 새 Worker entrypoint가 `/exchange` 전에 `GITHUB_API_BASE`의 scheme·origin·userinfo·port·path·query·fragment를 검증하고, lookalike/malformed 설정은 rate-limit·OIDC parsing·private-key 사용·GitHub API 호출 전에 `503 ERR_GITHUB_API`로 실패-폐쇄하며 허용 값도 canonical origin으로 치환한다. `/health`는 설정 복구 중에도 유지하고 원본 설정값은 응답·로그에 노출하지 않는다.
 - `src/**/*.ts` 전체에 statements·branches·functions·lines 100% coverage threshold를 강제하고, `/exchange` wrapper·OIDC replay guard·distributed limiter의 fail-closed 및 malformed-decision 경계를 회귀 테스트로 고정했다. 새 source branch가 coverage를 낮추면 CI가 즉시 실패한다.
 - `/exchange` distributed rate-limit identity가 없는 요청을 shared `unknown` bucket으로 합치지 않고 `503`으로 실패-폐쇄하도록 강화. Cloudflare의 `CF-Connecting-IP`가 정확히 하나의 유효한 IPv4/IPv6가 아니면 Durable Object lookup과 bearer parsing 전에 중단하고, 유효한 IPv6는 canonical form으로 정규화하여 동일 주소의 표기 차이가 rate-limit bucket을 분할하지 않도록 한다.
-- CI 검증 중 공개된 `undici` 취약점 묶음(GHSA-4cwx-7wf7-3272 포함)을 제거하기 위해 Wrangler→Miniflare 경유 transitive dependency를 patched `7.29.0`으로 override하고 lockfile을 재생성했다. `npm audit --audit-level=high`를 0건으로 복구하고 release gate가 취약 버전에서 실패-폐쇄하도록 유지한다.
+- CI 검증 중 공개된 `undici` 취약점 묶음(GHSA-4cwx-7wf7-3272 포함)을 제거하기 위해 Wrangler→Miniflare 경유 transitive dependency를 patched `7.29.0`으로 override하고 lockfile을 재생성했다. `npm audit --audit-level=high`가 0건으로 복구되고 release gate가 취약 버전에서 실패-폐쇄되도록 유지한다.
 - EOL 상태인 Node.js 20을 배포 계약에서 제거하고 `engines.node >=22` 및 배포 가이드의 지원 중 LTS 요구사항을 일치시켰다.
 - SQLite-backed OIDC replay guard의 alarm cleanup을 current-claim-aware 방식으로 강화. Cloudflare alarm의 at-least-once·지연·재시도 실행이 만료 후 교체된 활성 `jti` claim을 삭제하지 않도록 저장된 현재 expiry를 transactionally 재검증하고, 활성 claim이면 해당 만료 시각과 grace period로 reschedule하며 expired/empty storage만 삭제한다.
 - SQLite-backed `/exchange` rate limiter의 alarm cleanup을 current-window-aware 방식으로 강화. Cloudflare alarm의 지연·재시도 실행이 새 60초 window의 활성 bucket을 삭제해 요청 예산을 조기 재개하지 않도록 저장된 window deadline을 transactionally 재검증하고, 아직 활성인 경우 실제 reset 시각으로 reschedule하며 expired/empty storage만 삭제한다.

diff --git a/test/architecture-documentation.test.ts b/test/architecture-documentation.test.ts
@@ -29,7 +29,7 @@ describe("authoritative architecture documentation", () => {
     }
   });
 
-  it("binds the code-current architecture to Wrangler state classes and immutable workflow-source configuration", () => {
+  it("binds the code-current architecture to Wrangler state classes without duplicating the volatile workflow-source pin", () => {
     const wrangler = readFileSync("wrangler.toml", "utf8");
     const architecture = readFileSync("ARCHITECTURE.md", "utf8");
 
@@ -43,7 +43,9 @@ describe("authoritative architecture documentation", () => {
     expect(workflowSha).toBeDefined();
     expect(architecture).toContain("Code-current canonical architecture");
     expect(architecture).toContain("`ALLOWED_WORKFLOW_SHA`");
-    expect(architecture).toContain(workflowSha!);
+    expect(architecture).toContain("`wrangler.toml` is the canonical repository copy");
+    expect(architecture).toContain("deliberately does not duplicate that mutable 40-character value");
+    expect(architecture).not.toContain(workflowSha!);
     expect(architecture).not.toContain("Active PR #426");
     expect(architecture).not.toContain("not deployed truth until the PR integrates");
   });

diff --git a/test/trusted-workflow-runtime-state-preservation.test.ts b/test/trusted-workflow-runtime-state-preservation.test.ts
@@ -0,0 +1,12 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+describe("trusted workflow source roll-forward preserves deployed runtime state declarations", () => {
+  it("keeps the existing Durable Object exports instead of redeclaring deployed classes as new migrations", () => {
+    const wrangler = readFileSync(new URL("../wrangler.toml", import.meta.url), "utf8");
+
+    expect(wrangler).toContain('[exports.NoemaRateLimiter]\ntype = "durable-object"\nstorage = "sqlite"');
+    expect(wrangler).toContain('[exports.NoemaOidcReplayGuard]\ntype = "durable-object"\nstorage = "sqlite"');
+    expect(wrangler).not.toContain("new_sqlite_classes");
+  });
+});
diff --git a/test/trusted-workflow-source-rollforward.test.ts b/test/trusted-workflow-source-rollforward.test.ts
@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
 const auditedCentralWorkflowSourceSha =
-  "1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5";
+  "78271917b526469c559fa75cb5ee39426e5494d1";
 
 describe("trusted central workflow source revision", () => {
   it("binds the deployed OIDC trust configuration to the audited central source commit", () => {
@@ -12,4 +12,13 @@ describe("trusted central workflow source revision", () => {
       `ALLOWED_WORKFLOW_SHA = "${auditedCentralWorkflowSourceSha}"`,
     );
   });
-});
+
+  it("keeps the mutable exact source pin single-sourced in wrangler configuration", () => {
+    const architecture = readFileSync(new URL("../ARCHITECTURE.md", import.meta.url), "utf8");
+
+    expect(architecture).toContain(
+      "`wrangler.toml` is the canonical repository copy of the currently audited `ALLOWED_WORKFLOW_SHA`",
+    );
+    expect(architecture).not.toContain(auditedCentralWorkflowSourceSha);
+  });
+});
diff --git a/wrangler.toml b/wrangler.toml
@@ -24,7 +24,7 @@ ALLOWED_AUDIENCE = "cwl-noema-review"
 ALLOWED_REPOSITORY_OWNER = "ContextualWisdomLab"
 ALLOWED_WORKFLOW_REPOSITORY = "ContextualWisdomLab/.github"
 ALLOWED_WORKFLOW_REF_PREFIX = "ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main"
-ALLOWED_WORKFLOW_SHA = "1cbb6aaf0a24c3628d24c3dd6d9dcaa8a7eec0c5"
+ALLOWED_WORKFLOW_SHA = "78271917b526469c559fa75cb5ee39426e5494d1"
 GITHUB_API_BASE = "https://api.github.com"
 NOEMA_RATE_LIMIT_PER_MINUTE = "60"
 NOEMA_OIDC_JWKS_CACHE_TTL_SECONDS = "300"