From b65539c0db2a2fc3b5af1ed3f35a67f0752e5962 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:06:44 +0900 Subject: [PATCH 01/17] test(docs): reject stale procedural candidate authority --- ...umentation-current-trust-authority.test.ts | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index 8ff89ba5c..f8f990d3d 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -48,4 +48,24 @@ describe("current protected trust authority documentation", () => { ); expect(adoption).toContain("activationAuthorized: false"); }); + + it("keeps canonical procedural documentation aligned with protected source integration", () => { + const architecture = readFileSync("ARCHITECTURE.md", "utf8"); + const prd = readFileSync("docs/PRD.md", "utf8"); + const trd = readFileSync("docs/TRD.md", "utf8"); + const operability = readFileSync("docs/OPERABILITY.md", "utf8"); + const testStrategy = readFileSync("docs/TEST_STRATEGY.md", "utf8"); + const baseline = readFileSync("docs/product-technical-gap-baseline.md", "utf8"); + + expect(architecture).toContain("### 4.1 Protected procedural graph guidance"); + expect(architecture).not.toContain("Active PR #585 adds"); + expect(prd).toContain("Protected `main` includes a bounded **procedural graph advisory runtime** inside Agent Runtime."); + expect(prd).not.toContain("Active PR #585 proposes"); + expect(trd).toContain("### 2.4 Protected procedural graph advisory runtime"); + expect(trd).not.toContain("Active PR #585 adds"); + expect(operability).not.toContain("Active #585 procedural graph source"); + expect(testStrategy).not.toContain("The #585 procedural graph slice is library-only"); + expect(baseline).toContain("## Protected procedural graph advisory source — issue #584 / merged #585 + #586"); + expect(baseline).not.toContain("## Active procedural graph advisory candidate — issue #584 / PR #585"); + }); }); From 7d9b5f86acc1f8f5ac19d4ef72f06acb0a8a852e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:09:36 +0900 Subject: [PATCH 02/17] docs(agent-runtime): mark procedural graph as protected source --- ARCHITECTURE.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 8bd3c48a6..b1fd32478 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -86,13 +86,13 @@ flowchart LR The arrows from foreign owners carry immutable evidence identities only. Noema does not become their source of truth. -### 4.1 Candidate procedural graph guidance +### 4.1 Protected procedural graph guidance -Active PR #585 adds a library-only Agent Runtime aggregate for bounded procedural guidance. `src/agent-runtime/procedural-graph.ts` admits one immutable tenant/task/graph snapshot, canonicalizes nodes and directed relationships, computes local content/structure digests, and pins a module-admitted session to one canonical execution identity. `src/agent-runtime/procedural-evolution.ts` screens a direct child graph against paired held-out evidence but always returns `activationAuthorized: false`; eligibility is evidence for a later independent approval boundary, not permission to publish or execute a graph. +Protected source includes a library-only Agent Runtime aggregate for bounded procedural guidance. `src/agent-runtime/procedural-graph.ts` admits one immutable tenant/task/graph snapshot, canonicalizes nodes and directed relationships, computes local content/structure digests, and pins a module-admitted session to one canonical execution identity. `src/agent-runtime/procedural-evolution.ts` screens a direct child graph against paired held-out evidence but always returns `activationAuthorized: false`; eligibility is evidence for a later independent approval boundary, not permission to publish or execute a graph. `src/agent-runtime/procedural-execution.ts` additionally projects guidance only when its caller supplies a fresh authenticated `running` lifecycle snapshot for the same execution identity; it does not itself become durable lifecycle or revocation authority. The aggregate deliberately owns only Noema runtime mechanics. Procedural text is inert advisory data and is not tool authority, Policy / Approval, a prompt-injection verdict, a secret/PII scrubber, or product-domain truth. Graph/session WeakSet admission prevents structural lookalikes from becoming local runtime capabilities. Unknown procedures and context-budget overflow abstain without a hidden full-graph fallback. Execution identities reuse the canonical Agent Runtime grammar rather than defining a second identity domain. -Cross-product ownership remains outside this candidate: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials to Keyverse, and graph content/evaluation truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; source integration alone does not establish authenticated evaluation receipts, durable graph history, canary/rollback evidence, production activation, or organization-wide self-evolution. +Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials to Keyverse, and graph content/evaluation truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration alone does not establish authenticated evaluation receipts, durable graph history, current-lifecycle revocation, Policy / Approval CAS, canary/rollback evidence, production activation, or organization-wide self-evolution. ## 5. Evidence and authority separation @@ -140,7 +140,7 @@ Durable Object alarms are at-least-once. Handlers reread current deadline/expiry Candidate #574 adds separate Durable Object storage semantics for external-extension lifecycle evidence. The event log is append-only and is not the bounded Workflow / Task receipt ledger. Event/request digests are computed outside the short transaction; the transaction revalidates expected version, prior state, and prior head digest before atomically writing event + idempotency index + compact head. `readCurrent()` verifies only the head and exact tail for the latency-sensitive path, whereas `readAudit()` verifies every retained version/hash link and final head/tail identity. Corrupt or truncated durable state is a conflict, never an empty stream. Recovery and rollback must preserve acknowledged history and follow `docs/external-extension-lifecycle-recovery.md`. -The active procedural-graph candidate is intentionally non-durable. A graph digest or successful held-out screen is not retained activation authority. Durable history, authenticated evaluation receipts, approval CAS, canary state, rollback and recovery require a later owner-approved boundary; adding those concerns directly to the library candidate would collapse State / Checkpoint, Policy / Approval, and product-domain ownership. +The protected procedural-graph source is intentionally non-durable. A graph digest or successful held-out screen is not retained activation authority. Durable history, authenticated evaluation receipts, current-lifecycle revocation, approval CAS, canary state, rollback and recovery require a later owner-approved boundary; adding those concerns directly to the library aggregate would collapse State / Checkpoint, Policy / Approval, and product-domain ownership. ## 9. Standalone and modular MSA contract @@ -159,7 +159,7 @@ The active procedural-graph candidate is intentionally non-durable. A graph dige | OIDC/GitHub App | issuer/audience/repository/workflow-ref, immutable workflow-source SHA when configured, malformed token/JWKS, replay, redirect/egress, secret non-disclosure regressions | | Durable Objects | cross-instance semantics, delayed/retried alarm, current-state reschedule, malformed backend/storage-failure tests | | External-extension lifecycle | legal-edge validation; restart/replay/CAS races; exact Policy / Approval and foreign-owner reference binding; corruption/truncation/cross-stream rejection; >128-transition auditability; O(1) verified current projection; full audit/recovery rehearsal; actual Durable Object p95/contention/storage-growth evidence before runtime acceptance | -| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; later authenticated receipt/approval/canary evidence before activation | +| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; fresh authenticated lifecycle snapshot on execution projection; later authenticated receipt/durable revocation/approval/canary evidence before activation | | GitHub Actions/control plane | least privilege, exact-head/live-base binding, full pagination, stale-head refusal, evidence-class separation | | LLM integration | gateway contract, provider-key isolation, deterministic gates independent of model judgement | | release/acquisition | protected source, CI/security/coverage, package/SBOM/provenance/reproducibility, licensing/NOTICE, rollback/recovery, later operational/buyer evidence | @@ -172,7 +172,7 @@ Repository source/docs cannot fabricate stronger live `main` governance than the Candidate lifecycle source also cannot establish actual Durable Object p95, contention/partition behavior, backup/restore success, production recovery, or deployed invocation enforcement by documentation alone. Those remain later exact operational evidence. -Candidate procedural-graph source cannot establish authenticated evaluation provenance, cross-language/released digest semantics, durable version history, approval, canary operation, rollback success, or production outcome improvement. Those remain later contract, Policy / Approval, operational, and product-owner evidence. +Protected procedural-graph source cannot establish authenticated evaluation provenance, cross-language/released digest semantics, durable version history, current-lifecycle revocation, approval, canary operation, rollback success, or production outcome improvement. Those remain later contract, Policy / Approval, operational, and product-owner evidence. ## 12. Canonical documentation graph @@ -197,6 +197,6 @@ The default shape is **small credential-exchange service + explicit state coordi The external-extension lifecycle remains a bounded Tool Capability / State / Checkpoint aggregate rather than a new scanner, quarantine runtime, egress engine, identity provider, or model router. Its synchronous projection path and full audit/recovery path are deliberately separate so buyer/runtime latency does not require scanning retained history while recovery still verifies the complete chain. -The procedural-graph candidate remains a bounded Agent Runtime advisory aggregate rather than an execution engine or autonomous policy plane. It may select localized procedural context and screen a direct child candidate, but any future persistence, release, approval, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized: false` until those independent authorities are proven. +The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. It may select localized procedural context and screen a direct child candidate, and its execution adapter may project that context only against a caller-supplied fresh authenticated `running` lifecycle snapshot. Any future persistence, release, approval, current-lifecycle revocation, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized: false` until those independent authorities are proven. -Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth. \ No newline at end of file +Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth. From 08dc52a9c517d9f9d42d04a1e2bc8f934c8a2194 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:11:30 +0900 Subject: [PATCH 03/17] docs(agent-runtime): converge procedural product authority --- docs/PRD.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index f010bd511..37682779c 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -102,7 +102,9 @@ Protected `main` also includes the durable Workflow / Task Execution slice integ Protected source also includes the Noema-owned append-only external-extension lifecycle stream that grew from ADR 0015. Each stream is partitioned by the exact admitted extension/source/artifact identity; each transition binds monotonic version/state, prior-event/request/event SHA-256 evidence, exact Noema Policy / Approval and effective-scope identity, and immutable references/digests for AppGuardrail, quarantine/isolation, and Egress authority. A compact current projection verifies the exact durable tail for the synchronous path while full retained-prefix verification remains audit/recovery work. Exact duplicate requests are idempotent only after immutable replay verification, same-ID/different-semantics requests fail closed, and stale concurrent writers lose an expected-version/state/head CAS rather than being auto-rebased. A genuinely new `active` transition must re-read current Policy / Approval and owner evidence immediately before append; committed historical replay does not reconsult mutable authority. This implementation does not copy foreign scanner/runtime/outbound truth into Noema. Actual remote Durable Object performance, recovery, immutable owner-issued activation evidence, release, and deployment remain separate acceptance evidence rather than source-level claims. -Active PR #585 proposes a bounded **procedural graph advisory runtime** inside Agent Runtime. It admits immutable tenant/task-scoped graph snapshots, pins a locally admitted session to one canonical execution identity, returns only bounded local directed context or explicit abstention, and screens a direct child candidate against paired held-out evidence. Candidate screening always retains `activationAuthorized: false`: a non-regressing score is eligibility for a later independent approval boundary, not publication, tool, workflow, lifecycle, or activation authority. The first slice is intentionally non-durable and does not authenticate evaluation receipts, generate model edits, persist graph history, or implement canary/rollback. +Protected `main` includes a bounded **procedural graph advisory runtime** inside Agent Runtime. It admits immutable tenant/task-scoped graph snapshots, pins a locally admitted session to one canonical execution identity, returns only bounded local directed context or explicit abstention, and screens a direct child candidate against paired held-out evidence. Candidate screening always retains `activationAuthorized: false`: a non-regressing score is eligibility for a later independent approval boundary, not publication, tool, workflow, lifecycle, or activation authority. The protected graph/evaluation slice is intentionally non-durable and does not authenticate evaluation receipts, generate model edits, persist graph history, or implement canary/rollback. + +Protected source also includes the #586 execution-lifecycle adapter. It projects procedural guidance only when the caller supplies a fresh authenticated `running` lifecycle snapshot for the same canonical execution identity and suppresses guidance for accepted, cancellation-requested, or terminal states. The adapter is not itself durable lifecycle/revocation authority and cannot prove that a canonical `running` snapshot has not become stale after the caller obtained it. Procedural graph ownership follows existing CWL boundaries. Any released cross-service schema belongs to `context-graph-contracts`; enterprise adoption/decision records belong to `enterprise-architecture-core`; model discovery/routing remains in `contextual-orchestrator`; credentials remain in Keyverse; graph content and outcome/evaluation truth remain with the consuming product. Noema owns only the execution-local advisory mechanics and deterministic candidate-screening port. Mutable sibling PR heads are not production dependencies. @@ -133,7 +135,7 @@ Procedural graph ownership follows existing CWL boundaries. Any released cross-s | FR-021 | Model discovery, routing, test-time compute, provider failover, and provider credentials remain owned by `contextual-orchestrator`; Noema runtime code must not duplicate direct provider SDKs, credentials, fallback lists, or routing policy. | | FR-022 | Workflow/task, tool/capability, isolation, policy/approval, observability, recovery, Context Graph, and EA integration must cross explicit versioned ports/contracts; Context Graph integration must use immutable released versioned contracts, reject open or unreleased Draft contracts, and require conformance/admission evidence, canonical object/authority references, provenance, and valid/system time semantics. Arbitrary tool authority, ambient secret propagation, unbounded recursive work, silent side-effect retry, unreleased Context Graph source coupling, and cross-service SQL are forbidden. | | FR-023 | External-extension lifecycle authority must be append-only, exact-stream partitioned, restart-reconstructable, and CAS-serialized; current projection must be cryptographically bound to its audit tail, full audit must detect sequence/hash/stream truncation or substitution, exact duplicate replay must preserve committed history, and every genuinely new activation must bind a fresh Noema Policy / Approval and owner-evidence re-read without copying foreign-owner truth. | -| FR-024 | Procedural graph guidance must remain tenant/task/execution scoped, immutable and advisory-only; reject forged graph/session identities and unsafe input, return bounded localized context or explicit abstention, bind candidate screening to exact direct-child lineage and paired held-out context, prevent train/holdout leakage, reject safety or measured-score regression, and keep activation unauthorized until independent released-contract, authenticated evidence, Policy / Approval, persistence and rollout authorities are established. | +| FR-024 | Procedural graph guidance must remain tenant/task/execution scoped, immutable and advisory-only; reject forged graph/session identities and unsafe input, return bounded localized context or explicit abstention, bind candidate screening to exact direct-child lineage and paired held-out context, prevent train/holdout leakage, reject safety or measured-score regression, keep activation unauthorized, and project execution guidance only against a caller-supplied fresh authenticated `running` lifecycle snapshot for the same execution. Durable lifecycle freshness/revocation, released contracts, authenticated evaluation evidence, Policy / Approval, persistence and rollout authority remain separate prerequisites. | ## 6. Non-functional requirements @@ -191,7 +193,7 @@ Protected source can establish implementation contracts, deterministic tests, pa - 30-day production KPI evidence; - immutable release publication and deployment success unless those events actually occur; - customer/pilot, revenue/pipeline, support ownership, owner/legal rights, or contributor/IP transfer authority; -- authenticated procedural-evaluation provenance, durable procedural graph history, independent approval, canary/rollback success, or product-outcome improvement merely because a graph digest or `eligibleForApproval` result exists. +- authenticated procedural-evaluation provenance, durable procedural graph history/current-lifecycle revocation, independent approval, canary/rollback success, or product-outcome improvement merely because a graph digest or `eligibleForApproval` result exists. Those remain separate external or later-stage evidence and must fail closed when required but absent. @@ -230,4 +232,4 @@ An earlier stage never proves a later stage. - `docs/external-extension-lifecycle-recovery.md` — dedicated external-extension restart, audit-chain, corruption, CAS-contention, and rollback recovery contract. - `docs/DOCUMENTATION_GAP_AUDIT.md` — design sufficiency versus protected-main operational sufficiency. - runtime and automation threat models — distinct threat surfaces. -- `docs/LICENSING_AND_IP_TRANSFER.md` — owner/legal and exact-release rights boundary. \ No newline at end of file +- `docs/LICENSING_AND_IP_TRANSFER.md` — owner/legal and exact-release rights boundary. From 81336f8455c6cdcbe9b690f66a57b9cd316fdf03 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:14:02 +0900 Subject: [PATCH 04/17] docs(agent-runtime): converge procedural technical authority --- docs/TRD.md | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index 8183fecf4..a9485b691 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -52,15 +52,17 @@ Exact duplicate transition replay is returned only after immutable request/event Corrupt/truncated audit evidence is not repaired by the application path. Full recovery procedure, restore constraints, rollback semantics, future compaction constraints, and actual Durable Object recovery rehearsal requirements are defined in `docs/external-extension-lifecycle-recovery.md`. ADR 0015 remains `Proposed` while real-backend performance/recovery, immutable owner-issued activation evidence, release and deployment acceptance remain incomplete. -### 2.4 Candidate procedural graph advisory runtime +### 2.4 Protected procedural graph advisory runtime -Active PR #585 adds three library-only Agent Runtime modules: `procedural-input.ts`, `procedural-graph.ts`, and `procedural-evolution.ts`. The admission path snapshots exact-key plain records and dense bounded arrays through data descriptors, rejects accessors/proxies/extra authority-shaped fields, applies canonical execution identity and bounded procedural identity rules, canonicalizes graph ordering, and computes SHA-256 graph and structure identities under an explicit serialized byte ceiling. These digests are local content identities, not signatures or a released cross-language wire standard. +Protected source includes four library-only Agent Runtime modules: `procedural-input.ts`, `procedural-graph.ts`, `procedural-evolution.ts`, and `procedural-execution.ts`. The admission path snapshots exact-key plain records and dense bounded arrays through data descriptors, rejects accessors/proxies/extra authority-shaped fields, applies canonical execution identity and bounded procedural identity rules, canonicalizes graph ordering, and computes SHA-256 graph and structure identities under an explicit serialized byte ceiling. These digests are local content identities, not signatures or a released cross-language wire standard. `createProceduralGraph()` produces a deep-frozen tenant/task/graph snapshot and registers it in a module-local admission set. `startProceduralSession()` requires that admitted graph plus exact tenant/task/execution/digest agreement and returns an execution-pinned, locally admitted session. Directed neighborhood traversal is cycle-safe and bounded by hops/edge count; unknown procedures and exhausted context budgets return explicit abstention with no hidden full-graph fallback. Graph text stays inert `advisory_only` data and grants no tool, retry, lifecycle, Policy / Approval, credential, or product-domain authority. `assessProceduralCandidate()` accepts only an admitted direct-child graph, exact evaluation-context digest, disjoint training/held-out case identities, complete paired baseline/candidate observations, finite normalized scores and explicit safety-violation counts. It rejects lineage/context mismatch, train/holdout leakage, missing/duplicate cases, any candidate safety violation, mean score regression, repeated rejection keys and unchanged structure. A passing result is only `eligibleForApproval`; `activationAuthorized` is always `false`. Receipt authentication, durable graph/rejection history, approval CAS, canary/rollback and production outcome measurement are deliberately later boundaries. -Released cross-service procedural graph schemas belong to `context-graph-contracts`; enterprise adoption records belong to `enterprise-architecture-core`; model discovery/routing remains owned by `contextual-orchestrator`; credentials remain in Keyverse; graph content and product outcome truth remain with the consuming product. No mutable sibling PR-head dependency is accepted as production authority. +`guideProceduralExecution()` consumes only a locally admitted procedural session and a caller-supplied fresh authenticated lifecycle snapshot for the same canonical execution identity. It projects bounded advisory context only while that supplied lifecycle is `running`; accepted, cancellation-requested and terminal states suppress guidance. This pure adapter does not persist lifecycle state and cannot independently prove that a previously authenticated `running` snapshot has not become stale. Durable current-state/revocation remains a later State / Checkpoint + Policy / Approval authority. + +Released cross-service procedural graph schemas belong to `context-graph-contracts`; enterprise adoption records belong to `enterprise-architecture-core`; model discovery/routing remains owned by `contextual-orchestrator`; credentials remain in Keyverse; graph content and product outcome truth remain with the consuming product. No mutable sibling PR-head dependency is accepted as production authority. ADR 0017 remains `Proposed`: protected source integration is not release, deployment, approval, canary or activation evidence. ## 3. Identity and revision semantics @@ -303,7 +305,7 @@ Deterministic Node/npm과 lockfile control은 protected main의 `.github/lockfil - reviewer Python: line/branch 100%, public docstrings 100%. - workflow/document contracts: shipped YAML/docs/source 관계를 executable tests로 검증. - security: hostile input, stale identity, partial pagination, duplicate keys, symlink/race, provider/network failure 포함. -- procedural graph candidate: exact-key descriptor-safe input, forged/copied/proxy graph/session rejection, canonical digest/order behavior, cycle-safe bounded traversal, unknown/budget abstention, direct-child lineage, paired held-out completeness, train/holdout leakage, invalid score/safety regression, rejection replay, and `activationAuthorized: false` must be executable regressions before integration. +- procedural graph protected source: exact-key descriptor-safe input, forged/copied/proxy graph/session rejection, canonical digest/order behavior, cycle-safe bounded traversal, unknown/budget abstention, direct-child lineage, paired held-out completeness, train/holdout leakage, invalid score/safety regression, rejection replay, `activationAuthorized: false`, same-execution lifecycle gating and non-running suppression must remain executable regressions. - numerical/psychometric 계산이 추가되면 Rust-first CPU reference와 material GPU parity를 별도 requirement로 적용합니다. 자세한 내용은 `docs/TEST_STRATEGY.md`를 따릅니다. @@ -335,11 +337,11 @@ Deployment는 protected environment/governance, active runtime identity, traffic Protected external-extension lifecycle persistence owns exact-stream event records, transition-id replay index, and compact head projection. This storage is append-only for lifecycle events and is semantically separate from the bounded Workflow / Task transition-receipt ledger. It persists Noema lifecycle decision evidence plus immutable foreign-owner references/digests, never editable foreign-owner truth. Real Durable Object performance/recovery and immutable activation-owner evidence remain operational acceptance work. -The active #585 procedural graph candidate is intentionally non-durable: graph/session admission and candidate screening live in process memory and local immutable values. A graph digest, structure digest, rejection key, or `eligibleForApproval` result must not be promoted into durable activation authority. Any later store must define versioned schema, append/CAS/idempotency, authenticated receipt provenance, retention/recovery, approval binding and rollback separately before it can authorize rollout. +The protected procedural graph source is intentionally non-durable: graph/session admission, candidate screening, and execution-lifecycle projection remain process-local immutable authority values. A graph digest, structure digest, rejection key, `eligibleForApproval` result, or caller-supplied lifecycle snapshot must not be promoted into durable activation authority. Any later store must define versioned schema, append/CAS/idempotency, authenticated receipt provenance, current-lifecycle/revocation semantics, retention/recovery, approval binding and rollback separately before it can authorize rollout. -## Candidate implementation — PR #585 +## Protected procedural implementation -The active branch implements the procedural graph admission/session and offline direct-child candidate-screening ports with hostile tests for malformed descriptors, forged local authority, graph identity/scope, resource bounds, cycle-safe traversal, abstention, lineage/context mismatch, train/holdout leakage, paired evidence completeness, safety regression and measured-score regression. ADR 0017 remains `Proposed`; root architecture and traceability explicitly retain graph content as advisory-only and activation as unauthorized. The candidate is not a deployed route, graph store, model refiner, signed receipt verifier, automatic activation system or organization rollout. +Protected source implements procedural graph admission/session, offline direct-child candidate screening, and the #586 lifecycle-gated advisory projection with hostile tests for malformed descriptors, forged local authority, graph identity/scope, resource bounds, cycle-safe traversal, abstention, lineage/context mismatch, train/holdout leakage, paired evidence completeness, safety regression, measured-score regression, same-execution lifecycle binding, and non-running suppression. ADR 0017 remains `Proposed`; root architecture and traceability retain graph content as advisory-only and activation as unauthorized. This source is not a deployed route, durable graph store, model refiner, signed receipt verifier, automatic activation system, current-state revocation authority, or organization rollout. ## Implemented @@ -348,6 +350,7 @@ The active branch implements the procedural graph admission/session and offline - Worker routing, OIDC/GitHub App exchange, bounded request/egress controls. - distributed rate-limit and OIDC replay Durable Objects. - external-extension admission and append-only lifecycle storage/runtime binding, while real-backend operational/activation evidence remains separate. +- procedural graph local admission/session, deterministic direct-child screening, and lifecycle-gated advisory projection while durable revocation/approval/rollout evidence remains separate. - central-review/commercial-readiness/product-development/readiness/acquisition workflow 계열과 policy/test 기반. - evidence-class separation을 반영한 maintenance policy code. - configured 100% production coverage and reviewer-quality gates. @@ -361,7 +364,7 @@ The active branch implements the procedural graph admission/session and offline - issue #30의 organization-level runner-assignment root-cause evidence. - release/deployment provenance chain의 실제 production acceptance. - external-extension lifecycle actual Durable Object current-projection/contended-append p95 measurement, partition/lock/storage-growth capture, full audit rebuild, backup/restore or equivalent recovery rehearsal, and rollback/suspension verification before ADR 0015 can advance. -- #585 protected integration followed by released procedural wire-contract work, authenticated evaluation receipts, durable history/approval CAS, canary/rollback evidence and product-owner production outcome measurement before ADR 0017 can advance beyond its current Proposed/advisory-only state. +- released procedural wire-contract work, authenticated evaluation receipts, durable graph/rejection history and current-lifecycle/revocation authority, Policy / Approval CAS, canary/rollback evidence, and product-owner production outcome measurement before ADR 0017 can advance beyond its current Proposed/advisory-only state. ## External evidence @@ -373,7 +376,7 @@ repository source만으로 충족되지 않는 항목: - private vulnerability-reporting repository setting and benign exercise where required. - production environment protection and independent reviewer configuration. - production KPI/log provenance, deployment receipts/attestations. -- procedural graph evaluator identity/receipt authenticity, enterprise adoption approval, durable canary/rollback evidence, and product outcome truth from their owning systems. +- procedural graph evaluator identity/receipt authenticity, enterprise adoption approval, durable current-state/canary/rollback evidence, and product outcome truth from their owning systems. ## 17. References From 533faec243d10b90c5ba8160c67ff8b7d31e04db Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:14:55 +0900 Subject: [PATCH 05/17] docs(agent-runtime): converge procedural operability authority --- docs/OPERABILITY.md | 101 ++++---------------------------------------- 1 file changed, 9 insertions(+), 92 deletions(-) diff --git a/docs/OPERABILITY.md b/docs/OPERABILITY.md index 40c112db0..aeacadc31 100644 --- a/docs/OPERABILITY.md +++ b/docs/OPERABILITY.md @@ -32,7 +32,7 @@ 실제 credential-bearing protocol입니다. readiness가 녹색이어도 request-specific OIDC/repository/ref/SHA/replay/rate-limit/GitHub App validation은 별도로 통과해야 합니다. -운영 traffic readiness는 `/health` 하나가 아니라 `/ready`와 실제 bounded smoke contract를 함께 사용합니다. Active #585 procedural graph source is library-only and must not be inferred from these HTTP health/readiness surfaces. +운영 traffic readiness는 `/health` 하나가 아니라 `/ready`와 실제 bounded smoke contract를 함께 사용합니다. The protected procedural graph source is library-only and must not be inferred from these HTTP health/readiness surfaces. ## 4. Deployment configuration inventory @@ -61,7 +61,7 @@ GitHub automation category: Upstream provider credentials such as `NVIDIA_NIM_API_KEY`, `NVIDIA_NIM_API_KEY_SUB`, `BYTEZ_API_KEY`, `OPENROUTER_API_KEY`, and `OPENAI_API_KEY` are not Noema model-job configuration. Provider discovery, model selection, retries, failover, and paid/free routing remain contextual-orchestrator authority. -The #585 procedural graph candidate adds **no deployment binding, secret, provider selector, database, cron or HTTP route**. Adding operational persistence or activation configuration before the released-contract, authenticated evidence and Policy / Approval boundaries exist would be a new reviewed change, not an implicit configuration step. +The protected procedural graph source, including its lifecycle-gated projection, adds **no deployment binding, secret, provider selector, database, cron or HTTP route**. Adding operational persistence or activation configuration before the released-contract, authenticated evidence and Policy / Approval boundaries exist would be a new reviewed change, not an implicit configuration step. Secret values must not be copied into runbooks, PR bodies, model prompts, retained artifacts or acquisition evidence. @@ -177,7 +177,7 @@ A non-strict `SKIP` because no production log exists is not production SLO proof For external-extension lifecycle evidence, record current-projection and contended-append latency separately. The target is p95 ≤20 ms where that path is synchronous buyer/runtime authority. O(1) storage cardinality, unit timing, a reduced sample, or cache-only warmup is not that evidence. Record the actual Durable Object backend, request count/window, contention pattern, stream cardinality, storage size and exact source/deployment identity used for the measurement. -The #585 library candidate has no production p95 claim because it has no deployed synchronous buyer path. If procedural graph lookup later enters such a path, measure the real end-to-end path under representative graph sizes and concurrency rather than promoting unit timing to production latency evidence. +The protected procedural graph library source has no production p95 claim because it has no deployed synchronous buyer path. If procedural graph lookup later enters such a path, measure the real end-to-end path under representative graph sizes and concurrency rather than promoting unit timing to production latency evidence. ### Automation indicators @@ -222,7 +222,7 @@ A contextual-orchestrator outage, capability rejection, or upstream condition su ### Procedural graph integrity incident -A forged/cross-scope graph/session, graph identity mismatch, unsafe descriptor, unknown procedure, exceeded context budget, evaluation-context mismatch, holdout leakage, safety regression or malformed score is a **local advisory/candidate-screening failure**, not permission to substitute another graph or widen context. Reject/abstain and retain bounded diagnostic identity. A product/runtime caller must not fall back to unbounded graph disclosure, a mutable sibling source, model-generated tool authority, or automatic activation. +A forged/cross-scope graph/session, graph identity mismatch, unsafe descriptor, unknown procedure, exceeded context budget, evaluation-context mismatch, holdout leakage, safety regression or malformed score is a **local advisory/candidate-screening failure**, not permission to substitute another graph or widen context. Reject/abstain and retain bounded diagnostic identity. A product/runtime caller must not fall back to unbounded graph disclosure, a mutable sibling source, model-generated tool authority, or automatic activation. A stale caller-supplied `running` lifecycle snapshot is likewise not evidence of current authorization; current-state/revocation authority must be obtained from its owning durable boundary before guidance is treated as current. ### GitHub Actions queue incident @@ -269,9 +269,9 @@ For external-extension lifecycle state, never “repair” corruption by editing - foreign scanner, quarantine/isolation, egress, identity/secret, or model-routing rollback remains the canonical owner's operation and is referenced by immutable receipt/profile identity rather than copied into Noema; - if lifecycle storage schema or binding changes, restore/rehearse the exact migration and prefix-continuity path before reactivation. -### Procedural graph candidate +### Procedural graph advisory -The current #585 slice has no activation, deployment binding or durable graph store to roll back. Source rollback is an ordinary reviewed source rollback. If a future graph is activated, rollback must be a separately modeled Policy / Approval and durable-version/canary operation; deleting or mutating an old graph digest or treating a lower-scoring candidate as automatically active is not an acceptable rollback contract. +The protected procedural graph source has no activation, deployment binding or durable graph store to roll back. Source rollback is an ordinary reviewed source rollback. The #586 execution adapter does not make a stale `running` snapshot current; callers must reacquire current lifecycle authority from its owner. If a future graph is activated, rollback must be a separately modeled Policy / Approval and durable-version/canary operation; deleting or mutating an old graph digest or treating a lower-scoring candidate as automatically active is not an acceptable rollback contract. ## 12. Recovery acceptance @@ -287,7 +287,7 @@ Recovery is complete only when the exact recovered source/configuration has: For an external-extension lifecycle stream, recovery additionally requires: current projection matches the verified audit tail; complete retained event ordering, prior-event hash chain, request/event digests and stream identity verify; restart reconstructs current state without client-supplied authority; old exact replay still returns the historical event/snapshot; new activation rechecks live Noema Policy / Approval and owner evidence; suspension/rollback state remains effective; and any snapshot/segment rotation proves continuity with the retained immutable prefix. -Procedural graph process-local admission is recreated from trusted caller input after process restart and is not itself recovery evidence. A later durable store must prove exact version/digest continuity, authenticated receipt provenance, active approval identity and canary/rollback state before recovery can claim that a previously active graph is restored. +Procedural graph process-local admission is recreated from trusted caller input after process restart and is not itself recovery evidence. A later durable store must prove exact version/digest continuity, authenticated receipt provenance, active approval identity, current lifecycle/revocation authority and canary/rollback state before recovery can claim that a previously active graph is restored. ## 13. Release and production acceptance @@ -331,93 +331,10 @@ Evidence retention follows data class and existing security/disclosure policy. B External-extension lifecycle retention is append-only audit evidence rather than a bounded observability ring. Storage/segmentation policy must preserve the exact event prefix and head continuity; capacity management cannot delete early lifecycle evidence. The persisted schema remains payload-minimized and reference/digest based. -The active procedural graph candidate retains no durable graph/evaluation ledger. If such retention is added later, retain only purpose-bound versioned evidence needed for evaluation/approval/rollback and keep raw product data, secrets, hidden reasoning and provider credentials outside Noema storage. +The protected procedural graph source retains no durable graph/evaluation ledger. If such retention is added later, retain only purpose-bound versioned evidence needed for evaluation/approval/rollback and keep raw product data, secrets, hidden reasoning and provider credentials outside Noema storage. A lifecycle snapshot supplied to the process-local adapter is not a retained revocation ledger. Coordinated vulnerability disclosure/retention specifics must be verified from current protected source and the live owner issue/PR before operational acceptance; moving PR numbers are not durable authority. ## 15. Operator runbooks and commands -This canonical operability document does not duplicate every command. Use: - -- `docs/runbook.md` — runtime incident/operations commands; -- `docs/hourly-commercial-readiness-loop.md` — maintenance loop operation; -- `docs/operations/hourly-product-development.md` — proposal pipeline; -- `docs/deployment-guide.md` — deployment procedure; -- `docs/observability-kpi.md` — KPI definitions; -- `docs/security-validation-checklist.md` — security evidence; -- `docs/buyer-due-diligence-index.md` — acquisition evidence index. - -## 16. Operational evidence status - -### Implemented code/control families - -Runtime health/exchange, readiness/security state, maintenance/development workflows, external-extension admission/lifecycle and evidence scripts exist in repository history/protected source. Exact deployed revision is always live-verified rather than inferred from this document. Protected lifecycle source does not by itself prove real-backend p95/recovery or immutable owner-issued activation evidence. - -### Active proposed integration - -Draft #585 contains the procedural graph advisory/session and deterministic direct-child candidate-screening source. It is not a deployed service, durable graph store, signed evaluation-receipt verifier, Policy / Approval issuer, automatic refiner, activation system or organization rollout. Current exact PR/head/check state must be read live; this document intentionally does not freeze a moving SHA. - -### External / not yet proven by source - -- issue #27 enforced `main` governance; -- issue #29 Maintainer/Reviewer App provisioning and activation; -- production environment independent governance; -- actual Durable Object external-extension lifecycle deployment, realistic current-projection/contended-append p95, partition/storage-growth evidence, snapshot rebuild and recovery rehearsal; -- procedural graph released cross-service schema, authenticated evaluator receipts, durable version/rejection history, approval CAS, canary/rollback operation and product outcome improvement; -- current production KPI/deployment/release acceptance; -- commercial/revenue/transfer completeness. - -## 17. External extension admission and rollback - -External Claude community plugins are handled only through Noema's Tool / Capability admission port. Marketplace metadata, a scanner PASS, an isolation receipt, or a structurally compatible caller object is not invocation authority. - -Operational invariants: - -- only the composite authority instance bound when Noema admits an extension may mediate later activation and invocation; swapping in a lookalike catalog/scan/policy port fails closed; -- activation and every invocation re-read the live admission-bound Policy / Approval authority, while invocation also revalidates the exact catalog and AppGuardrail/quarantine receipt identities through that same bound trust channel; -- policy revocation or drift, catalog drift, missing/revoked scan evidence, expired validity, rollback marking, activation mismatch, or replay-envelope conflict stops new use rather than falling back to stale admission evidence; -- the Claude wrapper is `developer_assist` only. Product-runtime adoption must use the canonical product owner's released protocol/API through its own port and ACL; -- AppGuardrail and quarantine remain scanner/provenance and isolation owners, EgressWeave remains outbound-policy owner, Keyverse remains identity/secret-handle owner, and contextual-orchestrator remains model/provider-routing owner. Noema stores references and admission authority; it does not duplicate those implementations; -- raw provider credentials, product records, secrets, hidden reasoning, and unrestricted filesystem/network/process/MCP capabilities never become extension receipts or implicit runtime authority. - -Rollback for the Noema-owned portion means suspending/revoking the applicable Policy / Approval grant or appending the appropriate lifecycle suspension/supersession/expiry transition so new activation/invocation fails closed. Disabling an installed developer workspace plugin, terminating quarantine execution, changing outbound policy, rotating secrets, or repairing scanner evidence stays with the corresponding canonical owner and must be evidenced separately. - -A protected source merge proves only source integration. Live plugin installation, immutable shared-contract consumption, AppGuardrail/quarantine/EgressWeave operation, lifecycle Durable Object deployment/performance/recovery, measured pilot value, release publication, and rollback rehearsal remain separate evidence classes and must not be inferred from source tests or PR checks. - -## 18. External-extension lifecycle operating procedure - -The lifecycle stream is Noema State / Checkpoint evidence keyed by extension plus exact admitted source/artifact identity. Operators should treat the current projection and full audit as different evidence surfaces. - -For a current-state read: - -1. resolve the canonical stream identity from the exact admitted artifact; -2. read the compact head and its exact tail event; -3. verify schema, stream, version/state/head binding and retained request/event digests; -4. fail closed if the head or tail is missing, malformed, cross-stream or inconsistent; -5. do not scan the full retained history on the latency-sensitive current path solely to manufacture confidence. - -For audit/recovery: - -1. list the complete retained event prefix in sequence order; -2. verify version continuity, prior-event digest chain, request digest, event digest and stream identity for every event; -3. verify the compact head equals the terminal event; -4. verify early events remain present after >128 transitions and after any snapshot/segment operation; -5. reconcile rollback/suspension/supersession against current Policy / Approval without rewriting history. - -For a new `active` append, fresh Policy / Approval and foreign-owner evidence must be read immediately before the CAS path. Exact duplicate requests first consult durable idempotency evidence. If a writer misses that index, another writer commits the exact activation, and live evidence then fails, the loser may return replay only after the newly committed request/event/head/tail passes immutable verification. This exception preserves idempotency of historical evidence; it does not permit a new activation under revoked authority. - -Operational acceptance is pending until the actual Durable Object binding demonstrates realistic latency/contention/storage/recovery behavior and a protected/released/deployed source identity is retained with the measurement. Until then ADR 0015 stays Proposed and #561 remains open. - -## 19. Procedural graph operational acceptance - -The #585 candidate has a deliberately short operating contract because it is a pure library boundary rather than an activated service. - -1. Accept only exact descriptor-safe tenant/task graph input through the module-owned admission path. -2. Bind a session to the same tenant/task, canonical execution ID and expected graph digest; copied/forged/proxy lookalikes are not runtime capabilities. -3. Return only bounded local advisory context; unknown procedure or exhausted budget abstains rather than widening disclosure. -4. Screen a candidate only as an admitted direct child under exact paired held-out evaluation context with no train/holdout identity overlap. -5. Treat any safety violation or measured mean regression as rejection even when other metrics improve. -6. Preserve `activationAuthorized: false` for every decision. `eligibleForApproval` is evidence for the next boundary only. -7. Do not persist or activate a candidate until a released owner contract, authenticated evaluation provenance, explicit Policy / Approval, durable version/history semantics and canary/rollback evidence are separately implemented and reviewed. - -There is therefore no current procedural-graph production traffic, rollback metric or durability SLO to claim. A future activation PR must add those evidence classes rather than retrospectively interpreting #585 unit tests as production acceptance. \ No newline at end of file +This canonical operability document does not duplicate every repository command or historical run identifier. Operators should use the current protected scripts and package commands as executable authority, and retain exact revision/run evidence in the owning issue, PR, release or deployment receipt. Any command that can mutate source, policy, credentials, deployment, state, or evidence must be checked against the current live owner and exact target before execution. From b8475973b87375935be61115ef41cf8c3651a3a0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:15:51 +0900 Subject: [PATCH 06/17] docs(agent-runtime): converge procedural test authority --- docs/TEST_STRATEGY.md | 49 +++++++++++++++++-------------------------- 1 file changed, 19 insertions(+), 30 deletions(-) diff --git a/docs/TEST_STRATEGY.md b/docs/TEST_STRATEGY.md index 39081a379..cc2f7750a 100644 --- a/docs/TEST_STRATEGY.md +++ b/docs/TEST_STRATEGY.md @@ -29,9 +29,10 @@ Coverage 대상과 제외는 `vitest.config.ts` 및 reviewer CI가 source of tru - KPI/evidence schema logic; - Tool / Capability external-extension admission, explicit Policy / Approval, activation provenance, causally ordered invocation receipts, and lifecycle event canonicalization/digest validation; - procedural graph exact-key/descriptor-safe input, canonical ordering/content identities, deep immutability, local graph/session admission, bounded directed traversal and explicit abstention; -- direct-child procedural candidate screening with exact evaluation-context binding, paired held-out completeness, train/holdout separation, safety rejection, score non-regression and `activationAuthorized: false`. +- direct-child procedural candidate screening with exact evaluation-context binding, paired held-out completeness, train/holdout separation, safety rejection, score non-regression and `activationAuthorized: false`; +- procedural execution projection with exact same-execution lifecycle identity, `running`-only guidance, and suppression for accepted/cancellation-requested/terminal lifecycle states. -핵심은 attacker-controlled input에 대한 closed-set acceptance입니다. Procedural graph digest나 screening result는 로컬 deterministic evidence이며 signature, released cross-language contract, Policy / Approval 또는 activation authority로 테스트하지 않습니다. +핵심은 attacker-controlled input에 대한 closed-set acceptance입니다. Procedural graph digest나 screening result는 로컬 deterministic evidence이며 signature, released cross-language contract, Policy / Approval 또는 activation authority로 테스트하지 않습니다. Caller-supplied lifecycle state도 durable freshness/revocation evidence로 승격하지 않습니다. ### 3.2 Stateful component tests @@ -47,7 +48,7 @@ Coverage 대상과 제외는 `vitest.config.ts` 및 reviewer CI가 source of tru 시간 테스트는 과거 alarm이 새 window/claim을 제거하지 않는지 확인합니다. Lifecycle 테스트는 새 `active` 권한과 이미 commit된 historical evidence를 구분합니다. 새 activation은 fresh owner evidence 없이는 실패해야 하지만, exact durable replay는 이후 mutable owner-state 변화 때문에 소급 무효화되지 않습니다. -The active procedural-graph candidate is intentionally **not** a stateful component: process-local WeakSet graph/session admission and candidate decisions must not be presented as durable history, replay protection, revocation, approval CAS or rollback evidence. When a later durable graph store is introduced, it requires a separate stateful test family rather than reusing these unit results. +The protected procedural-graph source is intentionally **not** a stateful component: process-local WeakSet graph/session admission, candidate decisions and lifecycle-gated advisory projection must not be presented as durable history, replay protection, current-state revocation, approval CAS or rollback evidence. When a later durable graph store or lifecycle-revocation adapter is introduced, it requires a separate stateful test family rather than reusing these unit results. ### 3.3 Runtime API integration tests @@ -62,7 +63,7 @@ The active procedural-graph candidate is intentionally **not** a stateful compon - GitHub App installation response validation; - no secret reflection/logging. -The #585 procedural graph slice is library-only and therefore must not acquire an HTTP route merely to satisfy integration-test shape. A later runtime endpoint needs its own authenticated/authorized contract and E2E evidence. +The protected procedural graph source is library-only and therefore must not acquire an HTTP route merely to satisfy integration-test shape. A later runtime endpoint needs its own authenticated/authorized contract and E2E evidence. ### 3.4 Workflow contract tests @@ -120,7 +121,7 @@ Examples: - external-extension lifecycle current-state/restart recovery against the actual Durable Object storage backend; - lifecycle stream contention, storage growth, early-event audit continuity, suspension/rollback recovery, and compact projection rebuild. -이 evidence가 없으면 code branch의 GREEN을 operational completion으로 표현하지 않습니다. Lifecycle unit tests의 in-memory storage adapter와 O(1) storage-cardinality proof는 실제 Durable Object p95나 transaction compatibility를 대체하지 않습니다. Procedural graph unit/screening GREEN likewise does not prove a released shared schema, authenticated evaluator receipt, persistent graph history, canary/rollback, activation or product-value improvement. +이 evidence가 없으면 code branch의 GREEN을 operational completion으로 표현하지 않습니다. Lifecycle unit tests의 in-memory storage adapter와 O(1) storage-cardinality proof는 실제 Durable Object p95나 transaction compatibility를 대체하지 않습니다. Procedural graph unit/screening/lifecycle-projection GREEN likewise does not prove a released shared schema, authenticated evaluator receipt, durable current lifecycle/revocation history, canary/rollback, activation or product-value improvement. ## 4. Test-first workflow @@ -141,7 +142,7 @@ exact failing evidence External-extension lifecycle 변경은 특히 다음 RED를 보존합니다: illegal edge, stale/gapped expected version, concurrent CAS, cross-extension/artifact substitution, >128-transition audit continuity, malformed/truncated/tampered head/event/snapshot, retention of forbidden secret/product/reasoning content, current projection tail loss, transaction-time idempotency race, old exact replay after later head movement, and preflight miss → competing exact activation commit → fresh evidence failure. Digest 작업을 짧은 storage transaction 내부로 옮겨 race test를 GREEN으로 만드는 것도 허용하지 않습니다. -Procedural graph 변경은 다음 RED를 보존합니다: extra/missing/accessor/sparse/proxy input, duplicate/dangling graph structure, invalid scope/identity/digest, copied/forged graph or session capability, mutation after admission, cycle-safe finite traversal, unknown-node abstention, context-budget exhaustion without prerequisite truncation, direct-child lineage mismatch, stale/mismatched evaluation context, duplicate/incomplete paired held-out cases, train/holdout leakage, non-finite/out-of-range score, any candidate safety violation, mean score regression, contextual rejection replay and every decision's `activationAuthorized: false`. A test must not make local hash equality or `eligibleForApproval` stand in for receipt authentication or activation authority. +Procedural graph 변경은 다음 RED를 보존합니다: extra/missing/accessor/sparse/proxy input, duplicate/dangling graph structure, invalid scope/identity/digest, copied/forged graph or session capability, mutation after admission, cycle-safe finite traversal, unknown-node abstention, context-budget exhaustion without prerequisite truncation, direct-child lineage mismatch, stale/mismatched evaluation context, duplicate/incomplete paired held-out cases, train/holdout leakage, non-finite/out-of-range score, any candidate safety violation, mean score regression, contextual rejection replay and every decision's `activationAuthorized: false`. Execution projection additionally preserves same-execution binding, structural-session rejection, `running`-only guidance, accepted/cancellation-requested/terminal suppression and explicit caller-currentness precondition. A test must not make local hash equality, `eligibleForApproval`, or a caller-supplied `running` snapshot stand in for receipt authentication, durable revocation or activation authority. ## 5. Exact-head acceptance @@ -190,7 +191,8 @@ base-sensitive logic은 PR event의 snapshot만 사용하지 않습니다. - symlink/hardlink/path traversal/race-prone files; - external-extension lifecycle payloads containing forbidden prompt plaintext, raw product data, secret-like values, hidden reasoning, or provider credentials; - forged lifecycle stream/artifact identity, digest, transition ID, persisted request digest, event digest, current head, or audit tail; -- procedural graph/session records with accessors, exotic prototypes, extra authority fields, sparse arrays, invalid canonical identities, unbounded text/edge/case counts, forged structural copies or cross-scope graph/session substitution. +- procedural graph/session records with accessors, exotic prototypes, extra authority fields, sparse arrays, invalid canonical identities, unbounded text/edge/case counts, forged structural copies or cross-scope graph/session substitution; +- procedural execution requests with foreign execution identity, forged session capability, malformed lifecycle snapshot, or non-running state presented as current guidance authority. ### Network / egress @@ -226,7 +228,8 @@ base-sensitive logic은 PR event의 snapshot만 사용하지 않습니다. - if a competing exact `active` transition commits while another writer is awaiting fresh Policy / Approval or owner evidence, the latter rechecks durable exact replay before propagating evidence failure; a non-identical or unverifiable transition remains failed closed; - full audit verification catches retained-prefix truncation while current projection stays O(1) by verifying only its exact bound tail; - procedural graph/session snapshots are detached/frozen so caller mutation after admission cannot alter graph identity or local advisory capability; -- cycle traversal and context budgets remain bounded regardless of adversarial graph connectivity; no hidden full-graph or silent truncation fallback is permitted. +- cycle traversal and context budgets remain bounded regardless of adversarial graph connectivity; no hidden full-graph or silent truncation fallback is permitted; +- procedural execution projection must not reinterpret a caller-cached lifecycle snapshot as durable current-state/revocation evidence; callers reacquire that authority from the owning boundary. ## 9. LLM-dependent tests @@ -285,13 +288,17 @@ A direct-child graph has a higher held-out mean but one candidate observation re Training and held-out identities overlap, paired cases are incomplete, or a receipt binds a different evaluation-context digest. Screening fails closed rather than manufacturing a comparable score. +### Scenario L — stale lifecycle snapshot + +A caller presents an otherwise canonical locally admitted procedural session with a cached `running` lifecycle snapshot after current lifecycle authority has moved. The pure execution adapter cannot prove freshness by itself, so the caller must reacquire authenticated current lifecycle state from the owning durable boundary before the snapshot can be used as current authority. Tests must not upgrade the adapter into a hidden revocation store. + ## 11. Documentation tests Canonical architecture documentation is executable product surface because agents/operators use it to make security decisions. `test/documentation-architecture-contract.test.ts` requires the PRD, TRD, root Architecture, ADR index, UML, ERD, traceability, test strategy and operability documents. Additional architecture tests bind route claims to actual source modules and Wrangler bindings. -Documentation test should verify **material invariants**, not unstable prose formatting or temporary run IDs. External-extension lifecycle docs must distinguish protected admission behavior from lifecycle operational evidence, foreign-owner references from Noema truth, compact projection from full audit/recovery, and source integration from real Durable Object/performance/release/pilot evidence. Procedural graph docs must distinguish the active advisory-only source candidate from protected/deployed behavior, local digest/session admission from released/authenticated authority, `eligibleForApproval` from activation, and Noema runtime mechanics from context-graph-contracts/EA/model/credential/product-owner truth. +Documentation tests should verify **material invariants**, not unstable prose formatting or temporary run IDs. External-extension lifecycle docs must distinguish protected admission behavior from lifecycle operational evidence, foreign-owner references from Noema truth, compact projection from full audit/recovery, and source integration from real Durable Object/performance/release/pilot evidence. Procedural graph docs must distinguish protected advisory source from deployed/activated behavior, local digest/session admission from released/authenticated authority, `eligibleForApproval` from activation, caller-supplied lifecycle snapshots from durable current-state/revocation authority, and Noema runtime mechanics from context-graph-contracts/EA/model/credential/product-owner truth. ## 12. Release acceptance @@ -307,24 +314,6 @@ For any failed gate: 2. reproduce/isolate the first failing boundary; 3. identify recent relevant source/config/base changes; 4. form one falsifiable hypothesis; -5. enumerate distinct remedies and verify feasibility; -6. test-first implement the smallest source fix; -7. re-run focused test, full verification and exact-head check; -8. if the item is waiting, rotate to other safe work. - -Flake, infrastructure, provider and product regressions are not conflated without evidence. - -## 14. Credential-exchange coverage truth - -Issue #84's historical broad V8 coverage exclusions are no longer protected-main truth. Protected `main` `15ccf1226fe92468dc0a0e3761f3fe8bb328f2a9` contains no `v8 ignore` directive in `src/index.ts` after the bounded #404, #405, #406 and #408 coverage/security slices. - -The surviving test contract is therefore stricter than the historical plan: - -- credential-exchange, OIDC, replay/request, and GitHub App runtime branches remain ordinary owned production coverage targets; -- a newly introduced broad `/* v8 ignore start */` / `/* v8 ignore stop */` region in owned credential/security code is a regression, not an acceptable way to restore 100%; -- residual unreachable branches should be removed or their contracts tightened when proven impossible rather than excluded; -- realistic public `/exchange` paths are preferred over exporting private helpers solely for coverage; -- malformed OIDC/JWKS/GitHub upstream material must keep its fail-closed error classification while being measured; -- protected-main coverage acceptance still requires exact configured 100% statement/branch/function/line evidence on the current source head; predecessor #404/#405/#406/#408 results remain historical once source moves. - -Canonical traceability and documentation-fitness records must describe this as implemented protected-source behavior, not as an active broad-exclusion gap. This documentation correction does not by itself close issue #84 until the surviving canonical graph integrates and the protected-main documentation/coverage contract is exercised. \ No newline at end of file +5. enumerate distinct remedies and choose the smallest safe causal repair; +6. rerun focused and full exact-head verification without weakening gates; +7. preserve predecessor failures as historical evidence, not current authority. From 84a371476f617f2d1df19ead3cc4c0d1390193c7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:18:28 +0900 Subject: [PATCH 07/17] docs(agent-runtime): converge procedural product gap baseline --- docs/product-technical-gap-baseline.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4be4b5da9..00553fa61 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,11 +4,11 @@ 이 문서는 protected source, active candidate, transient workflow evidence와 foreign-owner authority를 분리한다. Open PR exact head, protected base, required workflow, review thread, release와 central dependency는 mutation·merge·release 직전에 다시 읽는다. predecessor GREEN, queued/pending/in-progress/skipped/cancelled run, 오래된 PR base snapshot과 scanner/model judgement는 다음 revision의 merge authority로 전용하지 않는다. queued는 GREEN이 아니다. -Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@748970213509d1383115c4196ed99fc9ee49742e`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive와 merged #583의 live-authority/ADR-index documentation repair를 포함한다. +Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@56550e5e6b0af81290800d7c5a0a4caa9040a39a`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, 그리고 merged #587의 source-vs-rollout doctoring repair를 포함한다. Moving central control-plane snapshot은 central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. -Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. +Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring integration #587이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. 이 baseline과 executable documentation-authority test는 active documentation-authority lane 하나만 write한다. mutation 직전 open PR/Issue/branch를 fresh-read해 writer를 결정하며 merged/closed historical PR 번호를 active sole writer로 고정하지 않는다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다. @@ -18,7 +18,7 @@ Noema Core Domain은 Agent Runtime과 Workflow / Task Execution이다. Tool / Ca `contextual-orchestrator`는 provider/model discovery, routing, retry/failover, test-time compute와 provider credential을 소유한다. Noema는 released gateway contract와 canonical `orchestrator/free` alias를 소비하며 direct provider SDK, provider key, provider/model/group fallback policy를 소유하지 않는다. `.github`는 organization reusable workflow/control-plane source다. Keyverse는 identity backend다. `quarantine-sandbox-runtime`, Wardnet, EgressWeave, AppGuardrail은 각자의 isolation/security/outbound/scanning truth를 소유한다. Noema는 그 owner evidence를 reference/pin으로 소비할 뿐 foreign implementation이나 domain table을 복제하지 않는다. Cross-service SQL과 mutable sibling PR dependency는 금지한다. -Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. Active ADR 0017 is also `Proposed`: #585 may establish bounded Noema Agent Runtime advisory graph/session mechanics and deterministic direct-child screening, but released wire contracts, authenticated evaluator receipts, durable history/approval CAS, canary/rollback and product-outcome authority remain outside that source slice. +Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics, deterministic direct-child screening, caller-supplied fresh authenticated lifecycle snapshot에 대한 running-only projection을 구현했지만 released wire contracts, authenticated evaluator receipts, durable history/current-lifecycle revocation, Policy / Approval CAS, canary/rollback과 product-outcome authority는 여전히 별도다. ## Integrated exact-claim evidence — issue #555 / merged PR #556 @@ -44,7 +44,7 @@ Invocation-authority substitution RED `abcd1fea4b28b826826fed6b23296b59ceda98ca` Exact-admission provenance RED `0a32ee0a88378931a07b7e3b61cc31e3b494a7ab`는 source admission A에서 발행한 authentic activation이 동일 trusted authority가 source B로 이동한 뒤에도 artifact/product/role/policy/time이 맞으면 B를 authorize할 수 있던 결함을 재현했다. Hosted application CI `34235691056`, job `102092675348`은 exact checkout/live-base/lockfile/install/typecheck 뒤 release tests에서 실패했다. Test-only `49115306b4abf7656f7fd136de8a3ff0c5a1968b`은 retained activation replay와 public invocation-receipt replay까지 확장했다. Canonical production `225a04ec2c833e9068e79ad7b70f3f5d8f6d934a`는 core의 activation/receipt provenance를 process-global set에서 exact `AdmittedExternalExtension`-bound map으로 옮겼고, `2e843825cc31a316a5834db3d355e8e4a18ca028`은 public wrapper에 잠시 중복됐던 binding kernel을 제거해 exact-admission activation/receipt authority를 core 한 곳에 남겼다. 같은 conformance invariant는 `context-graph-contracts#27`에 foreign-owner requirement로 넘겼고 mutable issue/branch를 Noema runtime dependency로 소비하지 않는다. -Plaintext replay-retention RED `3f41d94af1454926b65b1801004fe245098742b0`는 public replay WeakMap이 reversible `JSON.stringify(normalizedRequest)`를 receipt lifetime 동안 보유해 instruction, observed content, rejected secret/product/hidden-reasoning inputs의 수명을 불필요하게 늘리던 결함을 고정했다. Hosted application CI `34237704683`, job `102099615873`은 exact checkout/live-base/lockfile/install/release typecheck 뒤 release tests에서 실패했다. Production `79182c7be196c42fb94450cae9a7857ae67b5434`는 retained replay identity를 versioned/domain-separated SHA-256 digest로 바꾸고 every semantic field, key-order independence, fixed-width/no-plaintext regression을 추가했다. ADR `ac6b6c088f034a8778bdc8a859f7157223883b8d`는 process-local WeakMap lifetime, restart fail-closed, explicit digest-version migration과 FIPS 180-4 authority를 기록하며 `Proposed`를 유지한다. +Plaintext replay-retention RED `3f41d94af1454926b65b1801004fe245098742b0`는 public replay WeakMap이 reversible `JSON.stringify(normalizedRequest)`를 receipt lifetime 동안 보유해 instruction, observed content, rejected secret/product/hidden-reasoning inputs의 수명을 불필요하게 늘리던 결함을 고정했다. Hosted application CI `34237704683`, job `102099615873`은 exact checkout/live-base/lockfile control, install/release typecheck 뒤 release tests에서 실패했다. Production `79182c7be196c42fb94450cae9a7857ae67b5434`는 retained replay identity를 versioned/domain-separated SHA-256 digest로 바꾸고 every semantic field, key-order independence, fixed-width/no-plaintext regression을 추가했다. ADR `ac6b6c088f034a8778bdc8a859f7157223883b8d`는 process-local WeakMap lifetime, restart fail-closed, explicit digest-version migration과 FIPS 180-4 authority를 기록하며 `Proposed`를 유지한다. 그 뒤 live security finding `5586918828`은 repository-owned TypeScript SHA-256 padding/schedule/rounds가 Tool / Capability bounded context에 불필요한 security-critical primitive ownership을 추가한다는 결함을 분리했다. Test-only `b50b43065098609118991e0b0b0b4936725c2899`은 platform `crypto.subtle.digest` 또는 independently maintained/audited exact-pinned provider를 요구하고 local `SHA256_INITIAL`, `SHA256_ROUND`, `sha256Hex` ownership을 금지했다. Hosted application CI `34240985563`, job `102111324942`은 exact checkout, live-base guard, lockfile control, install과 release typecheck를 통과한 뒤 release tests에서 terminal FAILURE가 되어 reality RED를 확정했다. 같은 generation의 reviewer-ci `34240985515`와 required Security Scan `34240985513`은 SUCCESS였고 image `34240985555`는 successor generation 때문에 CANCELLED되어 GREEN으로 전용하지 않는다. @@ -62,13 +62,13 @@ This source chain does not complete #561. A genuinely new `active` transition re Operational acceptance still requires the actual deployed SQLite Durable Object: realistic current-read and contended-append denominators with evaluator-computed p95 ≤20 ms where synchronous, exactly-one-winner CAS contention, >128-event audit/restart continuity, malformed/truncated state rejection, exact-object storage growth, PITR or equivalent recovery rehearsal, and deployment/release provenance authenticating the producer. Local/workerd timing, namespace storage charts, synthetic evidence and self-asserted JSON do not satisfy that boundary. -## Active procedural graph advisory candidate — issue #584 / PR #585 +## Protected procedural graph advisory source — issue #584 / merged #585 + #586 -The active procedural-graph lane adds a library-only Agent Runtime aggregate with strict descriptor-safe input, immutable tenant/task/graph snapshots, canonical content/structure identities, module-local graph/session admission, canonical execution identity, cycle-safe bounded directed context and explicit unknown/budget abstention. Its candidate-screening port accepts only an admitted direct child under exact paired held-out evidence, rejects training/holdout leakage, incomplete/duplicate cases, invalid scores, candidate safety violations and measured mean regression, and retains `activationAuthorized: false` for every decision. Graph/session identity and `eligibleForApproval` are local deterministic evidence, not signatures, durable state or Policy / Approval. +Protected source includes the library-only Agent Runtime procedural graph aggregate and its execution-lifecycle projection. The graph boundary uses strict descriptor-safe input, immutable tenant/task/graph snapshots, canonical content/structure identities, module-local graph/session admission, canonical execution identity, cycle-safe bounded directed context and explicit unknown/budget abstention. Candidate screening accepts only an admitted direct child under exact paired held-out evidence, rejects training/holdout leakage, incomplete/duplicate cases, invalid scores, candidate safety violations and measured mean regression, and retains `activationAuthorized: false` for every decision. `guideProceduralExecution()` projects context only from a locally admitted session when the caller supplies a fresh authenticated same-execution `running` lifecycle snapshot; accepted, cancellation-requested and terminal states suppress guidance. The adapter does not itself prove lifecycle freshness or own durable revocation. -Noema does not absorb the downstream owners to complete this lane. Released procedural graph wire/schema identity belongs to `context-graph-contracts`; enterprise adoption and decision records to `enterprise-architecture-core`; model discovery/routing to `contextual-orchestrator`; credentials to Keyverse; graph content, evaluation design and production outcome truth to the consuming product. The candidate therefore adds no provider SDK/key, persistent graph store, HTTP route, automatic model refiner, tool authority or activation path. +Noema does not absorb downstream owners to complete this lane. Released procedural graph wire/schema identity belongs to `context-graph-contracts`; enterprise adoption and decision records to `enterprise-architecture-core`; model discovery/routing to `contextual-orchestrator`; credentials to Keyverse; graph content, evaluation design and production outcome truth to the consuming product. Protected graph/session identity, `eligibleForApproval`, or a caller-supplied lifecycle snapshot are local deterministic/runtime evidence, not signatures, durable state, Policy / Approval or activation authority. This source adds no provider SDK/key, persistent graph store, HTTP route, automatic model refiner, tool authority or activation path. -Source acceptance requires the complete canonical documentation graph, exact-head full tests/typecheck/100% configured coverage, current-head review, required central Security Scan and patch-validator-image. Even after protected integration, ADR 0017 must remain `Proposed` until immutable released contracts, authenticated evaluation receipts, durable version/rejection history with approval CAS, canary/rollback evidence and product-owner production outcome evidence exist. Child #586 is a separate stacked lifecycle-gating delta and must reconverge non-force after the parent integrates before it can acquire protected-main checks. +Source integration is complete for #585/#586. ADR 0017 remains `Proposed` until immutable released contracts, authenticated evaluation receipts, durable graph/rejection history plus current-lifecycle/revocation authority, Policy / Approval CAS, canary/rollback evidence and product-owner production outcome evidence exist. Canonical documentation must describe that separation without treating historical PR numbers as moving current authority. ## Evidence and merge rules @@ -86,7 +86,7 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge | --- | --- | --- | --- | --- | --- | --- | | P0 | Exact-claim evidence supply chain | Tool/research claim이 producer evidence 없이 reviewer authority가 될 위험 | protected #556 + release/consumer lanes | Source integrated; producer/release/consumer open | protected source + execution/research producer + immutable Noema release + released central consumer corpus RED→GREEN | release/producer evidence를 별도 lane에서 완성 | | P0 | External extension lifecycle evidence | third-party extension의 stale/revoked authority, process-local lifecycle, forged operability 또는 unbound storage/recovery evidence가 runtime truth로 오인될 위험 | protected #574/#577/#578/#579/#580/#581/#582 + issue #561 | Lifecycle/SQLite DO source integrated; production activation adapter + deployed operability/recovery/release evidence open | immutable source + Noema Policy/Approval + immutable foreign-owner refs + append-only lifecycle/CAS/restart + exact deployed p95/contention/storage/recovery + deployment/release provenance | fail-closed `active`를 유지하고 immutable owner-issued refs가 준비된 뒤 production adapter를 연결한 후 actual deployed #561 acceptance를 실행 | -| P0 | Procedural graph advisory activation boundary | deterministic local graph/session/screening 결과가 signed contract, durable approval 또는 product authority처럼 소비될 위험 | issue #584 + active #585; stacked #586 follows | Source/docs in review; activation intentionally unavailable | protected exact source + unchanged-head gates + released `context-graph-contracts` contract + authenticated paired evaluation receipts + explicit Policy/Approval + durable history/CAS + canary/rollback + product-owner outcome evidence | #585 canonical docs와 exact-head gates를 완성해 먼저 통합하고, #586을 protected main에 non-force reconverge한 뒤 activation/state work는 별도 owner-approved successor로 분리 | +| P0 | Procedural graph advisory activation boundary | deterministic local graph/session/screening 결과나 caller-cached lifecycle snapshot이 signed contract, durable current-state approval 또는 product authority처럼 소비될 위험 | protected #585/#586 + issue #584 | Source integrated; canonical docs convergence in review; activation intentionally unavailable | protected exact source + released `context-graph-contracts` contract + authenticated paired evaluation receipts + explicit Policy/Approval + durable history/current-state revocation CAS + canary/rollback + product-owner outcome evidence | canonical docs를 protected source와 수렴한 뒤 authenticated evaluation + durable lifecycle/revocation + Policy/Approval CAS를 owner-approved successor로 진행 | | P0 | Protected-main governance closure | required Security workflow만으로 PR/review/history/deletion/bypass 통제를 증명했다고 오인할 위험 | issue #27 | Open; external control evidence absent | fresh live ruleset + required PR/review/conversation/history/deletion controls + independent bypass/break-glass evidence + protected-source governance receipt | source가 만들 수 없는 organization/admin control은 issue #27에서 독립 검증 | | P0 | Strict orchestrator/free consumer release | source 통합만으로 immutable consumer activation을 증명할 수 없음 | merged #535 + release lane | Source integrated; release/consumer open | version/tag/package/SBOM/provenance/reproducibility/rollback + released consumer | release-ready protected head에서만 publication | | P0 | Patch-validator operational publication | source/image CI success만으로 reusable immutable runtime을 증명할 수 없음 | issue #66 | Open; publication evidence absent | protected execution + immutable image/signature/SBOM/provenance/reproducibility/rollback | protected-main operational image receipt 뒤 immutable publication/signing/attestation/activation을 별도 증거로 완성 | @@ -97,4 +97,4 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge ## Release boundary -Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. \ No newline at end of file +Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. From f5dfc87c9737805eed3ed880d50aa1dca5e1bfe5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:19:44 +0900 Subject: [PATCH 08/17] docs(agent-runtime): converge procedural UML authority --- docs/UML.md | 213 +++------------------------------------------------- 1 file changed, 12 insertions(+), 201 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index 5b5c9dacd..beeb80815 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -16,7 +16,7 @@ flowchart LR REPLAY[NoemaOidcReplayGuard] TOOL[tool-capability admission] LIFE[external-extension lifecycle\nprotected source] - PROC[procedural graph advisory\ncandidate PR 585] + PROC[procedural graph advisory\nprotected source] end subgraph ReviewPlane[Review and model plane] @@ -66,6 +66,7 @@ flowchart LR EGRESS -. immutable policy reference .-> LIFE AGENT[Agent Runtime caller] -->|tenant/task/execution + graph digest| PROC + LIFE -. caller-supplied fresh authenticated lifecycle snapshot .-> PROC CGC -. future immutable released wire contract .-> PROC EA -. adoption/decision evidence, not runtime authority .-> PROC @@ -91,7 +92,7 @@ flowchart LR MODEL -. diagnostic only .-> REVIEWS ``` -`model judgement`에서 formal review/merge authority로 직접 가는 화살표가 없는 것이 의도입니다. `runner assignment evidence` 역시 job을 실행할 수 있는 runner가 배정됐는지를 나타내는 operational evidence일 뿐 check success로 직접 승격되지 않습니다. 외부 Tool Capability evidence 화살표도 reference/digest 전달만 뜻하며 AppGuardrail, quarantine runtime, Egress authority가 Noema로 이전된다는 뜻이 아닙니다. Procedural graph의 외부 화살표도 released schema/adoption evidence 경계만 나타내며 graph content, model routing, credentials 또는 activation authority를 Noema로 이전하지 않습니다. +`model judgement`에서 formal review/merge authority로 직접 가는 화살표가 없는 것이 의도입니다. `runner assignment evidence` 역시 job을 실행할 수 있는 runner가 배정됐는지를 나타내는 operational evidence일 뿐 check success로 직접 승격되지 않습니다. 외부 Tool Capability evidence 화살표도 reference/digest 전달만 뜻하며 AppGuardrail, quarantine runtime, Egress authority가 Noema로 이전된다는 뜻이 아닙니다. Procedural graph의 외부 화살표도 released schema/adoption evidence 경계만 나타내며 graph content, model routing, credentials 또는 activation authority를 Noema로 이전하지 않습니다. Lifecycle에서 procedural graph로 향하는 점선은 #586 adapter가 caller-supplied snapshot을 소비한다는 뜻일 뿐 Noema가 별도의 durable revocation authority를 graph aggregate 안에 복제한다는 뜻이 아닙니다. ## 2. Credential exchange sequence @@ -158,7 +159,7 @@ sequenceDiagram Digest 계산과 Web Crypto replay 검증을 짧은 storage transaction 밖에서 수행하는 것이 의도입니다. 새 `active`만 현재 owner evidence를 다시 읽고, 이미 commit된 exact replay는 이후 mutable authority 변화 때문에 역사에서 제거되지 않습니다. -### 2.2 Candidate procedural graph session and screening +### 2.2 Protected procedural graph session, screening, and lifecycle projection ```mermaid sequenceDiagram @@ -166,6 +167,7 @@ sequenceDiagram participant Caller as Agent Runtime caller participant Admit as Procedural graph admission participant Session as Execution-pinned session + participant Lifecycle as Caller lifecycle authority participant Screen as Candidate screening port participant Approval as Independent Policy / Approval boundary @@ -175,11 +177,13 @@ sequenceDiagram Caller->>Session: admitted graph + tenant/task/execution + expected digest Session->>Session: exact scope/identity match Session-->>Caller: locally admitted advisory-only session - Caller->>Session: last procedure + hops + maxEdges - alt known node within budget + Caller->>Lifecycle: acquire fresh authenticated lifecycle snapshot + Lifecycle-->>Caller: same-execution lifecycle snapshot + Caller->>Session: session + lifecycle + last procedure + hops + maxEdges + alt lifecycle = running and known node within budget Session-->>Caller: bounded localized advisory context - else unknown node or budget exceeded - Session-->>Caller: explicit abstention + empty graph slice + else accepted/cancellation/terminal, unknown node, or budget exceeded + Session-->>Caller: suppression or explicit abstention end Caller->>Screen: admitted baseline/direct child + evaluation plan + paired receipts @@ -192,7 +196,7 @@ sequenceDiagram end ``` -이 candidate는 graph/session을 process-local admission으로만 다룹니다. Evaluation receipt authenticity, persistence, approval CAS, canary/rollback, tool invocation과 production activation은 이 sequence 밖의 별도 authority입니다. +Protected procedural graph/session admission and candidate screening remain process-local, and #586 adds only a pure projection over caller-supplied current lifecycle evidence. Evaluation receipt authenticity, durable lifecycle freshness/revocation, graph persistence, approval CAS, canary/rollback, tool invocation and production activation remain outside this sequence as separate authorities. ## 3. PR maintenance sequence @@ -278,196 +282,3 @@ stateDiagram-v2 ``` 각 state 전이는 별도 evidence plane을 요구합니다. `Merged`는 `Released`나 `Deployed`의 동의어가 아닙니다. - -### 5.1 GitHub runner assignment state - -```mermaid -stateDiagram-v2 - [*] --> WorkflowQueued - WorkflowQueued --> RunnerUnassigned: no runner assignment observed - RunnerUnassigned --> RunnerAssigned: runner identity/group or job start observed - RunnerAssigned --> JobRunning: execution starts - JobRunning --> JobTerminal: terminal conclusion observed - RunnerUnassigned --> AssignmentUnknown: incomplete/malformed observation - RunnerAssigned --> AssignmentUnknown: evidence source becomes incomplete - AssignmentUnknown --> [*] - JobTerminal --> [*] -``` - -이 state machine은 **runner assignment evidence**를 workflow/check conclusion과 분리합니다. `RunnerAssigned` 또는 `JobRunning`은 hosted/self-hosted execution capacity가 해당 job에 도달했다는 operational evidence이지만 `success`가 아닙니다. `RunnerUnassigned`가 지속되면 issue #30의 runner-capacity/billing/runner-group/policy RCA 입력이 되며, source-code defect를 자동 생성하지 않습니다. PR #88은 이 관측 경계를 read-only audit로 구현하는 active proposal입니다. - -### 5.2 External-extension lifecycle state - -```mermaid -stateDiagram-v2 - [*] --> discovered - discovered --> source_pinned - discovered --> rejected - source_pinned --> statically_scanned - source_pinned --> rejected - statically_scanned --> quarantined - statically_scanned --> rejected - quarantined --> capability_reviewed - quarantined --> rejected - capability_reviewed --> approved_for_pilot - capability_reviewed --> rejected - approved_for_pilot --> active: fresh Policy / Approval + owner evidence - approved_for_pilot --> rejected - approved_for_pilot --> expired - active --> suspended - active --> superseded - active --> expired - suspended --> active: fresh Policy / Approval + owner evidence - suspended --> superseded - suspended --> rejected - suspended --> expired -``` - -Terminal `superseded`, `rejected`, `expired` 상태에는 구현상 outbound edge가 없습니다. Rollback은 과거 event/head 삭제가 아니라 합법적인 새 transition append로 표현합니다. - -### 5.3 Candidate procedural graph advisory state - -```mermaid -stateDiagram-v2 - [*] --> UntrustedGraph - UntrustedGraph --> AdmittedGraph: exact schema + scope + bounds + canonical digest - UntrustedGraph --> Rejected: malformed / forged / over budget - AdmittedGraph --> PinnedSession: exact tenant/task/execution/digest - PinnedSession --> LocalizedAdvice: known procedure within budget - PinnedSession --> Abstain: unknown procedure or budget exceeded - AdmittedGraph --> CandidateScreen: direct child + paired heldout evidence - CandidateScreen --> EligibleForApproval: non-regression + no safety violation - CandidateScreen --> RejectedCandidate: unchanged / prior rejection / safety / score regression - EligibleForApproval --> [*]: activationAuthorized=false - LocalizedAdvice --> [*]: advisory_only - Abstain --> [*] - Rejected --> [*] - RejectedCandidate --> [*] -``` - -`EligibleForApproval`은 activation state가 아닙니다. Durable history, receipt authentication, Policy / Approval, canary/rollback과 production outcome은 별도 state/authority로 추가돼야 하며 현재 candidate가 암묵적으로 생성하지 않습니다. - -## 6. Product-development proposal sequence - -현재 protected-main document는 three-runner isolation을 설명하고, PR #80은 publication race를 더 좁게 만드는 active proposed implementation입니다. - -```mermaid -sequenceDiagram - autonumber - participant Gate as Zero-PR / credential gate - participant Agent as Uncredentialed OpenCode runner - participant Artifact as Immutable proposal artifact - participant Verify as Fresh verifier runner - participant Publish as Non-executing publisher - participant App as Maintainer App - participant GitHub as GitHub - - Gate->>GitHub: read open PR queue + main identity - Gate-->>Agent: one bounded task if safe - Agent->>Agent: test-first change with NVIDIA NIM only - Agent->>Artifact: patch + base + digest + file/byte evidence - Artifact->>Verify: exact artifact - Verify->>Verify: apply, release:verify, compare digest - Verify-->>Publish: success permits publication stage - Artifact->>Publish: same immutable patch - Publish->>Publish: reconstruct without executing proposal - Publish->>GitHub: revalidate queue/base - Publish->>App: mint late-bound scoped token - App->>GitHub: conditionally create proposal branch - App->>GitHub: create PR - App->>GitHub: re-read server head/base and queue - GitHub-->>Publish: exact PR identity -``` - -후속 review/merge는 이 sequence의 일부가 아니라 commercial-readiness control plane의 책임입니다. - -## 7. Reviewer and merge authority flow - -```mermaid -flowchart TD - Model[Model judgement] -->|diagnostic input| ReviewWorkflow[Review workflow] - Checks[Required check runs] --> Gate[Deterministic merge gate] - Statuses[Commit statuses] --> Gate - Scanner[Scanner revision evidence] --> Gate - Threads[Review threads] --> Gate - Formal[Eligible formal reviews] --> Gate - ReviewWorkflow --> Formal - Ruleset[Live ruleset / branch protection] --> Gate - Gate -->|all applicable conditions| MergeAPI[SHA-bound merge authority] - MergeAPI --> Main[Protected main] - - Model -. no direct authority .-> MergeAPI - Checks -. no direct authority .-> MergeAPI -``` - -## 8. Deployment / control-plane topology - -```mermaid -flowchart TB - subgraph GitHubCloud[GitHub] - Target[Noema repository] - Org[ContextualWisdomLab/.github] - Actions[GitHub Actions] - ReviewerApp[Reviewer App] - MaintainerApp[Maintainer App] - end - - subgraph Cloudflare[Cloudflare] - Worker[Noema Worker] - RateDO[Rate-limit Durable Object] - ReplayDO[Replay Durable Object] - end - - subgraph CWL[CWL services] - Orch[contextual-orchestrator] - Naruon[naruon / consumers] - end - - Actions -->|GitHub OIDC| Worker - Worker --> RateDO - Worker --> ReplayDO - Worker -->|scoped installation token| Actions - Actions --> Orch - Actions --> ReviewerApp - Actions --> MaintainerApp - ReviewerApp --> Target - MaintainerApp --> Target - Naruon -. versioned protocol consumer .-> Worker - Org --> Actions -``` - -Failure domain은 의도적으로 분리합니다. Orchestrator/model 장애가 credential trust를 약화시키지 않고, Noema credential exchange 장애가 다른 CWL 서비스의 내부 데이터베이스를 직접 손상시키지 않아야 합니다. Candidate procedural graph는 이 topology에 별도 deployed service/store를 추가하지 않습니다. - -### 8.1 Lifecycle recovery flow - -Protected source의 lifecycle 저장 계약은 아래와 같지만, 실제 production performance/recovery acceptance가 완료됐다는 뜻은 아닙니다. - -```mermaid -flowchart TD - I[Exact stream identity] --> C[readCurrent] - C --> H[Persisted compact head] - H --> T[Exact tail event] - T --> V{head/tail/request/event digests verify?} - V -->|yes| S[Verified current state] - V -->|no| F[Fail closed] - - I --> A[readAudit] - A --> P[Complete retained event prefix] - P --> Q{versions + prior hashes + event/request digests + stream + head verify?} - Q -->|yes| R[Recovery/audit authority] - Q -->|no| F - - F --> X[Forensic recovery; preserve bytes] - X --> Y[Restore only independently evidenced consistent history] - Y --> A -``` - -Recovery가 과거 history를 조용히 truncate하거나 client-supplied state를 새 head로 승격하지 않는 것이 핵심입니다. 세부 절차와 실제 backend rehearsal acceptance는 `docs/external-extension-lifecycle-recovery.md`가 소유합니다. - -## 9. Diagram maintenance rules - -- source behavior가 바뀌면 해당 diagram과 executable contract를 같은 PR에서 갱신합니다. -- unmerged active PR 동작은 “현재 배포”로 표시하지 않습니다. -- identity/authority arrow는 convenience 때문에 추가하지 않습니다. -- persistent entity가 실제 저장소에 없는 경우 ERD의 conceptual entity와 혼동하지 않습니다. -- procedural graph candidate의 graph/session/digest/eligibility를 persistence, Policy / Approval, tool authority 또는 product outcome과 같은 상태로 표시하지 않습니다. \ No newline at end of file From d249549d8da7d4d9ed6d779db0211780927c2f36 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:21:02 +0900 Subject: [PATCH 09/17] docs(agent-runtime): converge procedural traceability authority --- docs/TRACEABILITY.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 4592ccd4d..67f019421 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -59,8 +59,8 @@ Each arrow is a separate authority. Success at an earlier stage cannot fabricate | Licensing/IP authority | licensing/IP contract | rights/evidence validators | duplicate-key/UTF-8/exact-artifact and rights-metadata tests | owner/legal grant and transfer evidence | Technical controls exist; legal authority external | | Release/acquisition readiness | release/provenance/acquisition contracts | release verification and evidence scripts, digest-bound revenue/transfer source documents | exact-source package/SBOM/provenance/readiness and retained-source byte-integrity tests | immutable release/deployment/customer/revenue/legal authority | Technical byte binding implemented; commercial/legal authenticity remains external | | External Claude plugin admission | ADR 0015 + issue #545 + FR-022 | `src/tool-capability/external-extension-admission.ts` local fail-closed port/ACL | external-extension suites covering mutable source, catalog mismatch, forged receipts, independent Policy / Approval, pilot ceiling, activation provenance, activation→invocation chronology, expiry/rollback, catalog drift, replay, instruction promotion, product-runtime wrappers, and secret/product/reasoning receipts | immutable `context-graph-contracts` artifact contract, AppGuardrail successor evidence, isolation/egress operation, measured pilots | Implemented on protected main as admission boundary; later shared-contract/pilot evidence remains separate | -| External-extension lifecycle State / Checkpoint evidence | ADR 0015 + issue #561 | active Draft `src/tool-capability/external-extension-lifecycle-store.ts` and `external-extension-lifecycle-evidence.ts`; foreign owners remain reference/digest authorities | hostile lifecycle suites covering legal edges, exact replay/conflict, expected-version/head CAS, restart/audit integrity, >128 retention, projection-tail integrity, transaction replay races, activation evidence races, Policy / Approval and effective-scope drift | unchanged-exact four-gate + clean review + protected integration; actual Durable Object p95/contention/storage-growth/recovery; immutable release/deployment/pilot evidence | Implemented on active PR / In review; ADR remains Proposed and operational evidence is not inferred from unit tests | -| Procedural graph advisory runtime | Proposed ADR 0017 + issue #584 | active Draft `src/agent-runtime/procedural-graph.ts`, `procedural-input.ts`, and `procedural-evolution.ts`; root `ARCHITECTURE.md` records the bounded-context/non-authority boundary | hostile schema/accessor/proxy/resource-limit tests; canonical graph/session identity and digest tests; cycle-safe bounded neighborhood tests; unknown/budget abstention; paired holdout leakage/completeness/context/lineage checks; safety and measured-score non-regression; `activationAuthorized: false` invariant | unchanged-exact four-gate + clean review + protected integration; canonical PRD/TRD/UML/product-gap synchronization; immutable released cross-service contract; authenticated evaluation receipts; durable history/approval CAS; canary/rollback and production outcome evidence | Implemented on active PR / In review; advisory-only and non-durable; activation remains explicitly unauthorized | +| External-extension lifecycle State / Checkpoint evidence | ADR 0015 + issue #561 | protected `src/tool-capability/external-extension-lifecycle-store.ts`, lifecycle evidence/runtime binding and private operability projection; foreign owners remain reference/digest authorities | hostile lifecycle suites covering legal edges, exact replay/conflict, expected-version/head CAS, restart/audit integrity, >128 retention, projection-tail integrity, transaction replay races, activation evidence races, Policy / Approval/effective-scope drift and storage projection validation | actual Durable Object p95/contention/storage-growth/recovery; immutable owner-issued activation authority; immutable release/deployment/pilot evidence | Implemented on protected main; ADR remains Proposed and operational evidence is not inferred from source/unit tests | +| Procedural graph advisory runtime | Proposed ADR 0017 + issue #584 | protected `src/agent-runtime/procedural-input.ts`, `procedural-graph.ts`, `procedural-evolution.ts`, and `procedural-execution.ts` | hostile schema/accessor/proxy/resource-limit tests; canonical graph/session identity and digest tests; cycle-safe bounded neighborhood tests; unknown/budget abstention; paired holdout leakage/completeness/context/lineage checks; safety and measured-score non-regression; `activationAuthorized: false`; same-execution `running` lifecycle gating and non-running suppression | immutable released cross-service contract; authenticated evaluation receipts; durable graph/rejection history and current-lifecycle/revocation authority; Policy / Approval CAS; canary/rollback and production outcome evidence | Implemented on protected main as advisory-only/non-durable source; activation remains explicitly unauthorized | ## 3. Live governance traceability @@ -83,7 +83,7 @@ Historical or integrated PR numbers are deliberately omitted from current owners | Acquisition coordination | issue #5 | Coordinates evidence families without promoting earlier evidence into buyer/legal/commercial authority. | | External Claude plugin admission | issue #545 | Local fail-closed Tool / Capability port only; marketplace installation, Anthropic review, isolation runtime, and shared-contract GA remain separate authorities. | | External-extension lifecycle persistence | issue #561 | Noema owns lifecycle State / Checkpoint / Recovery evidence; Policy / Approval plus AppGuardrail/quarantine/Egress/identity/model-routing authorities remain separate and are retained only as immutable references/digests. | -| Procedural graph advisory runtime | issue #584 | Noema owns bounded execution-local advisory graph/session mechanics and deterministic candidate screening. Released wire contracts, enterprise adoption, model routing, credentials, Policy / Approval, graph-domain truth, durable activation history and canary/rollback evidence remain with their canonical owners. | +| Procedural graph advisory runtime | issue #584 | Noema owns bounded execution-local advisory graph/session mechanics, deterministic candidate screening, and same-execution lifecycle-gated projection. Released wire contracts, enterprise adoption, model routing, credentials, durable current lifecycle/revocation, Policy / Approval, graph-domain truth and canary/rollback evidence remain with their canonical owners. | Canonical architecture/documentation is code-current by revision and is not owned by a historical documentation PR. Transient queue/green states belong to observation-scoped evidence, not timeless architecture claims. @@ -211,17 +211,18 @@ The compact projection is latency-oriented Noema State / Checkpoint authority; i strict tenant/task/graph input → canonical immutable graph + local structure/content digest → module-admitted execution-pinned session -→ bounded directed neighborhood or explicit abstention +→ caller acquires fresh authenticated same-execution lifecycle snapshot +→ running-only bounded directed neighborhood or explicit suppression/abstention → paired held-out baseline/candidate/context evidence → leakage/completeness/score/safety/non-regression screening → eligible_for_approval only → activationAuthorized: false -→ independent released-contract / receipt / Policy-Approval boundary -→ later durable history + canary/rollback evidence +→ independent released-contract / authenticated receipt / Policy-Approval boundary +→ later durable graph/rejection history + current-lifecycle revocation + canary/rollback evidence → production outcome evidence owned by the consuming product ``` -The first six steps are Noema Agent Runtime mechanics in the active #585 candidate. They do not authenticate the evaluator, sign receipts, publish a cross-language digest standard, persist graph history, grant tools, change execution lifecycle, or authorize activation. `context-graph-contracts` owns any released cross-service schema; `enterprise-architecture-core` owns enterprise adoption/decision records; `contextual-orchestrator` owns model discovery/routing; Keyverse owns credentials; the consuming product owns graph content and outcome truth. Any future activation path must add those authorities explicitly rather than inferring them from `eligibleForApproval` or a graph digest. +The graph/session, deterministic screening and lifecycle-gated projection steps are protected Noema Agent Runtime mechanics. They do not authenticate the evaluator, sign receipts, publish a cross-language digest standard, persist graph history, prove that a caller-cached lifecycle snapshot is still current, grant tools, or authorize activation. `context-graph-contracts` owns any released cross-service schema; `enterprise-architecture-core` owns enterprise adoption/decision records; `contextual-orchestrator` owns model discovery/routing; Keyverse owns credentials; the consuming product owns graph content and outcome truth. Any future activation path must add durable current-lifecycle/revocation, authenticated evidence and Policy / Approval authorities explicitly rather than inferring them from `eligibleForApproval`, a graph digest or a supplied `running` snapshot. ## 14. Update rule From 17a6c236bcc724bbad5f24f4767b08174740ee51 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:21:26 +0900 Subject: [PATCH 10/17] test(docs): cover canonical procedural authority graph --- test/documentation-current-trust-authority.test.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index f8f990d3d..a33941062 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -53,8 +53,10 @@ describe("current protected trust authority documentation", () => { const architecture = readFileSync("ARCHITECTURE.md", "utf8"); const prd = readFileSync("docs/PRD.md", "utf8"); const trd = readFileSync("docs/TRD.md", "utf8"); + const uml = readFileSync("docs/UML.md", "utf8"); const operability = readFileSync("docs/OPERABILITY.md", "utf8"); const testStrategy = readFileSync("docs/TEST_STRATEGY.md", "utf8"); + const traceability = readFileSync("docs/TRACEABILITY.md", "utf8"); const baseline = readFileSync("docs/product-technical-gap-baseline.md", "utf8"); expect(architecture).toContain("### 4.1 Protected procedural graph guidance"); @@ -63,9 +65,17 @@ describe("current protected trust authority documentation", () => { expect(prd).not.toContain("Active PR #585 proposes"); expect(trd).toContain("### 2.4 Protected procedural graph advisory runtime"); expect(trd).not.toContain("Active PR #585 adds"); + expect(trd).not.toContain("## Candidate implementation — PR #585"); + expect(uml).toContain("### 2.2 Protected procedural graph session, screening, and lifecycle projection"); + expect(uml).not.toContain("procedural graph advisory\\ncandidate PR 585"); expect(operability).not.toContain("Active #585 procedural graph source"); + expect(operability).not.toContain("The #585 procedural graph candidate adds"); expect(testStrategy).not.toContain("The #585 procedural graph slice is library-only"); + expect(testStrategy).not.toContain("The active procedural-graph candidate is intentionally **not** a stateful component"); + expect(traceability).toContain("Implemented on protected main as advisory-only/non-durable source"); + expect(traceability).not.toContain("The first six steps are Noema Agent Runtime mechanics in the active #585 candidate"); expect(baseline).toContain("## Protected procedural graph advisory source — issue #584 / merged #585 + #586"); expect(baseline).not.toContain("## Active procedural graph advisory candidate — issue #584 / PR #585"); + expect(baseline).toContain("ADR 0017도 `Proposed`다."); }); }); From 9e1278094b45fd4bea241e3e9a772a2ed2be800d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:24:17 +0900 Subject: [PATCH 11/17] fix(docs): preserve full UML while converging procedural authority --- docs/UML.md | 196 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 196 insertions(+) diff --git a/docs/UML.md b/docs/UML.md index beeb80815..b5d3175f6 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -282,3 +282,199 @@ stateDiagram-v2 ``` 각 state 전이는 별도 evidence plane을 요구합니다. `Merged`는 `Released`나 `Deployed`의 동의어가 아닙니다. + +### 5.1 GitHub runner assignment state + +```mermaid +stateDiagram-v2 + [*] --> WorkflowQueued + WorkflowQueued --> RunnerUnassigned: no runner assignment observed + RunnerUnassigned --> RunnerAssigned: runner identity/group or job start observed + RunnerAssigned --> JobRunning: execution starts + JobRunning --> JobTerminal: terminal conclusion observed + RunnerUnassigned --> AssignmentUnknown: incomplete/malformed observation + RunnerAssigned --> AssignmentUnknown: evidence source becomes incomplete + AssignmentUnknown --> [*] + JobTerminal --> [*] +``` + +이 state machine은 **runner assignment evidence**를 workflow/check conclusion과 분리합니다. `RunnerAssigned` 또는 `JobRunning`은 hosted/self-hosted execution capacity가 해당 job에 도달했다는 operational evidence이지만 `success`가 아닙니다. `RunnerUnassigned`가 지속되면 issue #30의 runner-capacity/billing/runner-group/policy RCA 입력이 되며, source-code defect를 자동 생성하지 않습니다. PR #88은 이 관측 경계를 read-only audit로 구현하는 active proposal입니다. + +### 5.2 External-extension lifecycle state + +```mermaid +stateDiagram-v2 + [*] --> discovered + discovered --> source_pinned + discovered --> rejected + source_pinned --> statically_scanned + source_pinned --> rejected + statically_scanned --> quarantined + statically_scanned --> rejected + quarantined --> capability_reviewed + quarantined --> rejected + capability_reviewed --> approved_for_pilot + capability_reviewed --> rejected + approved_for_pilot --> active: fresh Policy / Approval + owner evidence + approved_for_pilot --> rejected + approved_for_pilot --> expired + active --> suspended + active --> superseded + active --> expired + suspended --> active: fresh Policy / Approval + owner evidence + suspended --> superseded + suspended --> rejected + suspended --> expired +``` + +Terminal `superseded`, `rejected`, `expired` 상태에는 구현상 outbound edge가 없습니다. Rollback은 과거 event/head 삭제가 아니라 합법적인 새 transition append로 표현합니다. + +### 5.3 Protected procedural graph advisory state + +```mermaid +stateDiagram-v2 + [*] --> UntrustedGraph + UntrustedGraph --> AdmittedGraph: exact schema + scope + bounds + canonical digest + UntrustedGraph --> Rejected: malformed / forged / over budget + AdmittedGraph --> PinnedSession: exact tenant/task/execution/digest + PinnedSession --> LifecycleCheck: caller supplies fresh authenticated same-execution snapshot + LifecycleCheck --> LocalizedAdvice: running + known procedure within budget + LifecycleCheck --> Suppressed: accepted / cancellation-requested / terminal + LifecycleCheck --> Abstain: running + unknown procedure or budget exceeded + AdmittedGraph --> CandidateScreen: direct child + paired heldout evidence + CandidateScreen --> EligibleForApproval: non-regression + no safety violation + CandidateScreen --> RejectedCandidate: unchanged / prior rejection / safety / score regression + EligibleForApproval --> [*]: activationAuthorized=false + LocalizedAdvice --> [*]: advisory_only + Suppressed --> [*] + Abstain --> [*] + Rejected --> [*] + RejectedCandidate --> [*] +``` + +`EligibleForApproval`은 activation state가 아닙니다. `LifecycleCheck`도 caller-supplied snapshot의 currentness를 스스로 증명하는 durable revocation state가 아닙니다. Durable history, authenticated evaluation receipt, current lifecycle/revocation, Policy / Approval, canary/rollback과 production outcome은 별도 state/authority로 추가돼야 합니다. + +## 6. Product-development proposal sequence + +현재 protected-main document는 three-runner isolation을 설명하고, PR #80은 publication race를 더 좁게 만드는 active proposed implementation입니다. + +```mermaid +sequenceDiagram + autonumber + participant Gate as Zero-PR / credential gate + participant Agent as Uncredentialed OpenCode runner + participant Artifact as Immutable proposal artifact + participant Verify as Fresh verifier runner + participant Publish as Non-executing publisher + participant App as Maintainer App + participant GitHub as GitHub + + Gate->>GitHub: read open PR queue + main identity + Gate-->>Agent: one bounded task if safe + Agent->>Agent: test-first change with NVIDIA NIM only + Agent->>Artifact: patch + base + digest + file/byte evidence + Artifact->>Verify: exact artifact + Verify->>Verify: apply, release:verify, compare digest + Verify-->>Publish: success permits publication stage + Artifact->>Publish: same immutable patch + Publish->>Publish: reconstruct without executing proposal + Publish->>GitHub: revalidate queue/base + Publish->>App: mint late-bound scoped token + App->>GitHub: conditionally create proposal branch + App->>GitHub: create PR + App->>GitHub: re-read server head/base and queue + GitHub-->>Publish: exact PR identity +``` + +후속 review/merge는 이 sequence의 일부가 아니라 commercial-readiness control plane의 책임입니다. + +## 7. Reviewer and merge authority flow + +```mermaid +flowchart TD + Model[Model judgement] -->|diagnostic input| ReviewWorkflow[Review workflow] + Checks[Required check runs] --> Gate[Deterministic merge gate] + Statuses[Commit statuses] --> Gate + Scanner[Scanner revision evidence] --> Gate + Threads[Review threads] --> Gate + Formal[Eligible formal reviews] --> Gate + ReviewWorkflow --> Formal + Ruleset[Live ruleset / branch protection] --> Gate + Gate -->|all applicable conditions| MergeAPI[SHA-bound merge authority] + MergeAPI --> Main[Protected main] + + Model -. no direct authority .-> MergeAPI + Checks -. no direct authority .-> MergeAPI +``` + +## 8. Deployment / control-plane topology + +```mermaid +flowchart TB + subgraph GitHubCloud[GitHub] + Target[Noema repository] + Org[ContextualWisdomLab/.github] + Actions[GitHub Actions] + ReviewerApp[Reviewer App] + MaintainerApp[Maintainer GitHub App] + end + + subgraph Cloudflare[Cloudflare] + Worker[Noema Worker] + RateDO[Rate-limit Durable Object] + ReplayDO[Replay Durable Object] + end + + subgraph CWL[CWL services] + Orch[contextual-orchestrator] + Naruon[naruon / consumers] + end + + Actions -->|GitHub OIDC| Worker + Worker --> RateDO + Worker --> ReplayDO + Worker -->|scoped installation token| Actions + Actions --> Orch + Actions --> ReviewerApp + Actions --> MaintainerApp + ReviewerApp --> Target + MaintainerApp --> Target + Naruon -. versioned protocol consumer .-> Worker + Org --> Actions +``` + +Failure domain은 의도적으로 분리합니다. Orchestrator/model 장애가 credential trust를 약화시키지 않고, Noema credential exchange 장애가 다른 CWL 서비스의 내부 데이터베이스를 직접 손상시키지 않아야 합니다. Protected procedural graph source는 이 topology에 별도 deployed service/store를 추가하지 않습니다. + +### 8.1 Lifecycle recovery flow + +Protected source의 lifecycle 저장 계약은 아래와 같지만, 실제 production performance/recovery acceptance가 완료됐다는 뜻은 아닙니다. + +```mermaid +flowchart TD + I[Exact stream identity] --> C[readCurrent] + C --> H[Persisted compact head] + H --> T[Exact tail event] + T --> V{head/tail/request/event digests verify?} + V -->|yes| S[Verified current state] + V -->|no| F[Fail closed] + + I --> A[readAudit] + A --> P[Complete retained event prefix] + P --> Q{versions + prior hashes + event/request digests + stream + head verify?} + Q -->|yes| R[Recovery/audit authority] + Q -->|no| F + + F --> X[Forensic recovery; preserve bytes] + X --> Y[Restore only independently evidenced consistent history] + Y --> A +``` + +Recovery가 과거 history를 조용히 truncate하거나 client-supplied state를 새 head로 승격하지 않는 것이 핵심입니다. 세부 절차와 실제 backend rehearsal acceptance는 `docs/external-extension-lifecycle-recovery.md`가 소유합니다. + +## 9. Diagram maintenance rules + +- source behavior가 바뀌면 해당 diagram과 executable contract를 같은 PR에서 갱신합니다. +- unmerged active PR 동작은 “현재 배포”로 표시하지 않습니다. +- identity/authority arrow는 convenience 때문에 추가하지 않습니다. +- persistent entity가 실제 저장소에 없는 경우 ERD의 conceptual entity와 혼동하지 않습니다. +- procedural graph의 graph/session/digest/eligibility 또는 caller-supplied lifecycle snapshot을 persistence, durable current-state/revocation, Policy / Approval, tool authority 또는 product outcome과 같은 상태로 표시하지 않습니다. From 1d45c646d77cbde4a9b7035b3508b2216d0f6bca Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:25:27 +0900 Subject: [PATCH 12/17] fix(docs): preserve full operability runbook while converging procedural authority --- docs/OPERABILITY.md | 82 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 81 insertions(+), 1 deletion(-) diff --git a/docs/OPERABILITY.md b/docs/OPERABILITY.md index aeacadc31..6fc3d4f4e 100644 --- a/docs/OPERABILITY.md +++ b/docs/OPERABILITY.md @@ -337,4 +337,84 @@ Coordinated vulnerability disclosure/retention specifics must be verified from c ## 15. Operator runbooks and commands -This canonical operability document does not duplicate every repository command or historical run identifier. Operators should use the current protected scripts and package commands as executable authority, and retain exact revision/run evidence in the owning issue, PR, release or deployment receipt. Any command that can mutate source, policy, credentials, deployment, state, or evidence must be checked against the current live owner and exact target before execution. +This canonical operability document does not duplicate every command. Use: + +- `docs/runbook.md` — runtime incident/operations commands; +- `docs/hourly-commercial-readiness-loop.md` — maintenance loop operation; +- `docs/operations/hourly-product-development.md` — proposal pipeline; +- `docs/deployment-guide.md` — deployment procedure; +- `docs/observability-kpi.md` — KPI definitions; +- `docs/security-validation-checklist.md` — security evidence; +- `docs/buyer-due-diligence-index.md` — acquisition evidence index. + +## 16. Operational evidence status + +### Implemented code/control families + +Runtime health/exchange, readiness/security state, maintenance/development workflows, external-extension admission/lifecycle, procedural graph advisory/session/screening and lifecycle-gated projection, and evidence scripts exist in repository history/protected source. Exact deployed revision is always live-verified rather than inferred from this document. Protected source does not by itself prove real-backend p95/recovery, immutable owner-issued activation evidence, authenticated procedural evaluation, durable current-state revocation, release or deployment. + +### External / not yet proven by source + +- issue #27 enforced `main` governance; +- issue #29 Maintainer/Reviewer App provisioning and activation; +- production environment independent governance; +- actual Durable Object external-extension lifecycle deployment, realistic current-projection/contended-append p95, partition/storage-growth evidence, snapshot rebuild and recovery rehearsal; +- procedural graph released cross-service schema, authenticated evaluator receipts, durable graph/rejection history and current-lifecycle revocation, Policy / Approval CAS, canary/rollback operation and product outcome improvement; +- current production KPI/deployment/release acceptance; +- commercial/revenue/transfer completeness. + +## 17. External extension admission and rollback + +External Claude community plugins are handled only through Noema's Tool / Capability admission port. Marketplace metadata, a scanner PASS, an isolation receipt, or a structurally compatible caller object is not invocation authority. + +Operational invariants: + +- only the composite authority instance bound when Noema admits an extension may mediate later activation and invocation; swapping in a lookalike catalog/scan/policy port fails closed; +- activation and every invocation re-read the live admission-bound Policy / Approval authority, while invocation also revalidates the exact catalog and AppGuardrail/quarantine receipt identities through that same bound trust channel; +- policy revocation or drift, catalog drift, missing/revoked scan evidence, expired validity, rollback marking, activation mismatch, or replay-envelope conflict stops new use rather than falling back to stale admission evidence; +- the Claude wrapper is `developer_assist` only. Product-runtime adoption must use the canonical product owner's released protocol/API through its own port and ACL; +- AppGuardrail and quarantine remain scanner/provenance and isolation owners, EgressWeave remains outbound-policy owner, Keyverse remains identity/secret-handle owner, and contextual-orchestrator remains model/provider-routing owner. Noema stores references and admission authority; it does not duplicate those implementations; +- raw provider credentials, product records, secrets, hidden reasoning, and unrestricted filesystem/network/process/MCP capabilities never become extension receipts or implicit runtime authority. + +Rollback for the Noema-owned portion means suspending/revoking the applicable Policy / Approval grant or appending the appropriate lifecycle suspension/supersession/expiry transition so new activation/invocation fails closed. Disabling an installed developer workspace plugin, terminating quarantine execution, changing outbound policy, rotating secrets, or repairing scanner evidence stays with the corresponding canonical owner and must be evidenced separately. + +A protected source merge proves only source integration. Live plugin installation, immutable shared-contract consumption, AppGuardrail/quarantine/EgressWeave operation, lifecycle Durable Object deployment/performance/recovery, measured pilot value, release publication, and rollback rehearsal remain separate evidence classes and must not be inferred from source tests or PR checks. + +## 18. External-extension lifecycle operating procedure + +The lifecycle stream is Noema State / Checkpoint evidence keyed by extension plus exact admitted source/artifact identity. Operators should treat the current projection and full audit as different evidence surfaces. + +For a current-state read: + +1. resolve the canonical stream identity from the exact admitted artifact; +2. read the compact head and its exact tail event; +3. verify schema, stream, version/state/head binding and retained request/event digests; +4. fail closed if the head or tail is missing, malformed, cross-stream or inconsistent; +5. do not scan the full retained history on the latency-sensitive current path solely to manufacture confidence. + +For audit/recovery: + +1. list the complete retained event prefix in sequence order; +2. verify version continuity, prior-event digest chain, request digest, event digest and stream identity for every event; +3. verify the compact head equals the terminal event; +4. verify early events remain present after >128 transitions and after any snapshot/segment operation; +5. reconcile rollback/suspension/supersession against current Policy / Approval without rewriting history. + +For a new `active` append, fresh Policy / Approval and foreign-owner evidence must be read immediately before the CAS path. Exact duplicate requests first consult durable idempotency evidence. If a writer misses that index, another writer commits the exact activation, and live evidence then fails, the loser may return replay only after the newly committed request/event/head/tail passes immutable verification. This exception preserves idempotency of historical evidence; it does not permit a new activation under revoked authority. + +Operational acceptance is pending until the actual Durable Object binding demonstrates realistic latency/contention/storage/recovery behavior and a protected/released/deployed source identity is retained with the measurement. Until then ADR 0015 stays Proposed and #561 remains open. + +## 19. Procedural graph operational acceptance + +The protected procedural graph source has a deliberately short operating contract because it is a pure library boundary rather than an activated service. + +1. Accept only exact descriptor-safe tenant/task graph input through the module-owned admission path. +2. Bind a session to the same tenant/task, canonical execution ID and expected graph digest; copied/forged/proxy lookalikes are not runtime capabilities. +3. Before execution projection, require the caller to obtain a fresh authenticated lifecycle snapshot for the same execution identity; only `running` may receive guidance. The adapter does not become the durable freshness/revocation store. +4. Return only bounded local advisory context; unknown procedure or exhausted budget abstains rather than widening disclosure. +5. Screen a candidate only as an admitted direct child under exact paired held-out evaluation context with no train/holdout identity overlap. +6. Treat any safety violation or measured mean regression as rejection even when other metrics improve. +7. Preserve `activationAuthorized: false` for every decision. `eligibleForApproval` is evidence for the next boundary only. +8. Do not persist or activate a candidate until a released owner contract, authenticated evaluation provenance, explicit Policy / Approval, durable graph/version/current-lifecycle semantics and canary/rollback evidence are separately implemented and reviewed. + +There is therefore no current procedural-graph production traffic, rollback metric or durability SLO to claim. A future activation change must add those evidence classes rather than retrospectively interpreting protected #585/#586 unit tests as production acceptance. From 99547b43dd3421a1854203a7e63969131783019d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:31:12 +0900 Subject: [PATCH 13/17] test(docs): reject lifecycle authority conflation --- test/documentation-current-trust-authority.test.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index a33941062..30dd048a2 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -68,6 +68,8 @@ describe("current protected trust authority documentation", () => { expect(trd).not.toContain("## Candidate implementation — PR #585"); expect(uml).toContain("### 2.2 Protected procedural graph session, screening, and lifecycle projection"); expect(uml).not.toContain("procedural graph advisory\\ncandidate PR 585"); + expect(uml).not.toContain("LIFE -. caller-supplied fresh authenticated lifecycle snapshot .-> PROC"); + expect(uml).toContain("fresh authenticated `ExecutionLifecycle` snapshot from the Agent Runtime boundary"); expect(operability).not.toContain("Active #585 procedural graph source"); expect(operability).not.toContain("The #585 procedural graph candidate adds"); expect(testStrategy).not.toContain("The #585 procedural graph slice is library-only"); From dd8c82c1630707b18622fa84514ac9394d543daa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:33:29 +0900 Subject: [PATCH 14/17] fix(docs): separate Agent Runtime lifecycle authority --- docs/UML.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/docs/UML.md b/docs/UML.md index b5d3175f6..9b7f18edb 100644 --- a/docs/UML.md +++ b/docs/UML.md @@ -65,8 +65,7 @@ flowchart LR QUAR -. immutable evidence reference/digest .-> LIFE EGRESS -. immutable policy reference .-> LIFE - AGENT[Agent Runtime caller] -->|tenant/task/execution + graph digest| PROC - LIFE -. caller-supplied fresh authenticated lifecycle snapshot .-> PROC + AGENT[Agent Runtime caller] -->|tenant/task/execution + graph digest + fresh ExecutionLifecycle| PROC CGC -. future immutable released wire contract .-> PROC EA -. adoption/decision evidence, not runtime authority .-> PROC @@ -92,7 +91,7 @@ flowchart LR MODEL -. diagnostic only .-> REVIEWS ``` -`model judgement`에서 formal review/merge authority로 직접 가는 화살표가 없는 것이 의도입니다. `runner assignment evidence` 역시 job을 실행할 수 있는 runner가 배정됐는지를 나타내는 operational evidence일 뿐 check success로 직접 승격되지 않습니다. 외부 Tool Capability evidence 화살표도 reference/digest 전달만 뜻하며 AppGuardrail, quarantine runtime, Egress authority가 Noema로 이전된다는 뜻이 아닙니다. Procedural graph의 외부 화살표도 released schema/adoption evidence 경계만 나타내며 graph content, model routing, credentials 또는 activation authority를 Noema로 이전하지 않습니다. Lifecycle에서 procedural graph로 향하는 점선은 #586 adapter가 caller-supplied snapshot을 소비한다는 뜻일 뿐 Noema가 별도의 durable revocation authority를 graph aggregate 안에 복제한다는 뜻이 아닙니다. +`model judgement`에서 formal review/merge authority로 직접 가는 화살표가 없는 것이 의도입니다. `runner assignment evidence` 역시 job을 실행할 수 있는 runner가 배정됐는지를 나타내는 operational evidence일 뿐 check success로 직접 승격되지 않습니다. 외부 Tool Capability evidence 화살표도 reference/digest 전달만 뜻하며 AppGuardrail, quarantine runtime, Egress authority가 Noema로 이전된다는 뜻이 아닙니다. Procedural graph의 외부 화살표도 released schema/adoption evidence 경계만 나타내며 graph content, model routing, credentials 또는 activation authority를 Noema로 이전하지 않습니다. #586 adapter는 Agent Runtime boundary가 만든 fresh authenticated `ExecutionLifecycle` snapshot을 caller가 공급하는 구조입니다. Tool Capability의 external-extension lifecycle을 나타내는 `LIFE`는 이 snapshot의 authority가 아니며 procedural graph와 별도 bounded context로 유지됩니다. ## 2. Credential exchange sequence @@ -167,7 +166,7 @@ sequenceDiagram participant Caller as Agent Runtime caller participant Admit as Procedural graph admission participant Session as Execution-pinned session - participant Lifecycle as Caller lifecycle authority + participant Lifecycle as Agent Runtime ExecutionLifecycle authority participant Screen as Candidate screening port participant Approval as Independent Policy / Approval boundary @@ -196,7 +195,7 @@ sequenceDiagram end ``` -Protected procedural graph/session admission and candidate screening remain process-local, and #586 adds only a pure projection over caller-supplied current lifecycle evidence. Evaluation receipt authenticity, durable lifecycle freshness/revocation, graph persistence, approval CAS, canary/rollback, tool invocation and production activation remain outside this sequence as separate authorities. +Protected procedural graph/session admission and candidate screening remain process-local, and #586 adds only a pure projection over caller-supplied current Agent Runtime execution-lifecycle evidence. Evaluation receipt authenticity, durable lifecycle freshness/revocation, graph persistence, approval CAS, canary/rollback, tool invocation and production activation remain outside this sequence as separate authorities. ## 3. PR maintenance sequence From b75b513dc93f6d1c9114b4e2fd468c0c3a76db46 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:34:10 +0900 Subject: [PATCH 15/17] test(docs): bind execution lifecycle authority wording --- test/documentation-current-trust-authority.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index 30dd048a2..0bb727d44 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -69,7 +69,7 @@ describe("current protected trust authority documentation", () => { expect(uml).toContain("### 2.2 Protected procedural graph session, screening, and lifecycle projection"); expect(uml).not.toContain("procedural graph advisory\\ncandidate PR 585"); expect(uml).not.toContain("LIFE -. caller-supplied fresh authenticated lifecycle snapshot .-> PROC"); - expect(uml).toContain("fresh authenticated `ExecutionLifecycle` snapshot from the Agent Runtime boundary"); + expect(uml).toContain("Agent Runtime boundary가 만든 fresh authenticated `ExecutionLifecycle` snapshot"); expect(operability).not.toContain("Active #585 procedural graph source"); expect(operability).not.toContain("The #585 procedural graph candidate adds"); expect(testStrategy).not.toContain("The #585 procedural graph slice is library-only"); From 7a7e80fef6df9ffd6c8bf8053e56e01d6bbf4609 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:35:53 +0900 Subject: [PATCH 16/17] test(docs): preserve unrelated coverage authority --- test/documentation-current-trust-authority.test.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index 0bb727d44..1b5f473e4 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -74,6 +74,9 @@ describe("current protected trust authority documentation", () => { expect(operability).not.toContain("The #585 procedural graph candidate adds"); expect(testStrategy).not.toContain("The #585 procedural graph slice is library-only"); expect(testStrategy).not.toContain("The active procedural-graph candidate is intentionally **not** a stateful component"); + expect(testStrategy).toContain("## 14. Credential-exchange coverage truth"); + expect(testStrategy).toContain("test-first implement the smallest source fix"); + expect(testStrategy).toContain("if the item is waiting, rotate to other safe work"); expect(traceability).toContain("Implemented on protected main as advisory-only/non-durable source"); expect(traceability).not.toContain("The first six steps are Noema Agent Runtime mechanics in the active #585 candidate"); expect(baseline).toContain("## Protected procedural graph advisory source — issue #584 / merged #585 + #586"); From e76be4f8cf9ade4eca4ce462ba10234fa2c63da1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 15:38:16 +0900 Subject: [PATCH 17/17] fix(docs): preserve coverage and triage authority --- docs/TEST_STRATEGY.md | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/docs/TEST_STRATEGY.md b/docs/TEST_STRATEGY.md index cc2f7750a..e9fbea8d5 100644 --- a/docs/TEST_STRATEGY.md +++ b/docs/TEST_STRATEGY.md @@ -314,6 +314,24 @@ For any failed gate: 2. reproduce/isolate the first failing boundary; 3. identify recent relevant source/config/base changes; 4. form one falsifiable hypothesis; -5. enumerate distinct remedies and choose the smallest safe causal repair; -6. rerun focused and full exact-head verification without weakening gates; -7. preserve predecessor failures as historical evidence, not current authority. +5. enumerate distinct remedies and verify feasibility; +6. test-first implement the smallest source fix; +7. re-run focused test, full verification and exact-head check; +8. if the item is waiting, rotate to other safe work. + +Flake, infrastructure, provider and product regressions are not conflated without evidence. + +## 14. Credential-exchange coverage truth + +Issue #84's historical broad V8 coverage exclusions are no longer protected-main truth. Protected `main` `15ccf1226fe92468dc0a0e3761f3fe8bb328f2a9` contains no `v8 ignore` directive in `src/index.ts` after the bounded #404, #405, #406 and #408 coverage/security slices. + +The surviving test contract is therefore stricter than the historical plan: + +- credential-exchange, OIDC, replay/request, and GitHub App runtime branches remain ordinary owned production coverage targets; +- a newly introduced broad `/* v8 ignore start */` / `/* v8 ignore stop */` region in owned credential/security code is a regression, not an acceptable way to restore 100%; +- residual unreachable branches should be removed or their contracts tightened when proven impossible rather than excluded; +- realistic public `/exchange` paths are preferred over exporting private helpers solely for coverage; +- malformed OIDC/JWKS/GitHub upstream material must keep its fail-closed error classification while being measured; +- protected-main coverage acceptance still requires exact configured 100% statement/branch/function/line evidence on the current source head; predecessor #404/#405/#406/#408 results remain historical once source moves. + +Canonical traceability and documentation-fitness records must describe this as implemented protected-source behavior, not as an active broad-exclusion gap. This documentation correction does not by itself close issue #84 until the surviving canonical graph integrates and the protected-main documentation/coverage contract is exercised.