docs(agent-runtime): converge protected procedural authority

ARCHITECTURE.md

@@ -86,13 +86,13 @@ flowchart LR
 
 The arrows from foreign owners carry immutable evidence identities only. Noema does not become their source of truth.
 
-### 4.1 Candidate procedural graph guidance
+### 4.1 Protected procedural graph guidance
 
-Active PR #585 adds a library-only Agent Runtime aggregate for bounded procedural guidance. `src/agent-runtime/procedural-graph.ts` admits one immutable tenant/task/graph snapshot, canonicalizes nodes and directed relationships, computes local content/structure digests, and pins a module-admitted session to one canonical execution identity. `src/agent-runtime/procedural-evolution.ts` screens a direct child graph against paired held-out evidence but always returns `activationAuthorized: false`; eligibility is evidence for a later independent approval boundary, not permission to publish or execute a graph.
+Protected source includes a library-only Agent Runtime aggregate for bounded procedural guidance. `src/agent-runtime/procedural-graph.ts` admits one immutable tenant/task/graph snapshot, canonicalizes nodes and directed relationships, computes local content/structure digests, and pins a module-admitted session to one canonical execution identity. `src/agent-runtime/procedural-evolution.ts` screens a direct child graph against paired held-out evidence but always returns `activationAuthorized: false`; eligibility is evidence for a later independent approval boundary, not permission to publish or execute a graph. `src/agent-runtime/procedural-execution.ts` additionally projects guidance only when its caller supplies a fresh authenticated `running` lifecycle snapshot for the same execution identity; it does not itself become durable lifecycle or revocation authority.
 
 The aggregate deliberately owns only Noema runtime mechanics. Procedural text is inert advisory data and is not tool authority, Policy / Approval, a prompt-injection verdict, a secret/PII scrubber, or product-domain truth. Graph/session WeakSet admission prevents structural lookalikes from becoming local runtime capabilities. Unknown procedures and context-budget overflow abstain without a hidden full-graph fallback. Execution identities reuse the canonical Agent Runtime grammar rather than defining a second identity domain.
 
-Cross-product ownership remains outside this candidate: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials to Keyverse, and graph content/evaluation truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; source integration alone does not establish authenticated evaluation receipts, durable graph history, canary/rollback evidence, production activation, or organization-wide self-evolution.
+Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials to Keyverse, and graph content/evaluation truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration alone does not establish authenticated evaluation receipts, durable graph history, current-lifecycle revocation, Policy / Approval CAS, canary/rollback evidence, production activation, or organization-wide self-evolution.
 
 ## 5. Evidence and authority separation
 
@@ -140,7 +140,7 @@ Durable Object alarms are at-least-once. Handlers reread current deadline/expiry
 
 Candidate #574 adds separate Durable Object storage semantics for external-extension lifecycle evidence. The event log is append-only and is not the bounded Workflow / Task receipt ledger. Event/request digests are computed outside the short transaction; the transaction revalidates expected version, prior state, and prior head digest before atomically writing event + idempotency index + compact head. `readCurrent()` verifies only the head and exact tail for the latency-sensitive path, whereas `readAudit()` verifies every retained version/hash link and final head/tail identity. Corrupt or truncated durable state is a conflict, never an empty stream. Recovery and rollback must preserve acknowledged history and follow `docs/external-extension-lifecycle-recovery.md`.
 
-The active procedural-graph candidate is intentionally non-durable. A graph digest or successful held-out screen is not retained activation authority. Durable history, authenticated evaluation receipts, approval CAS, canary state, rollback and recovery require a later owner-approved boundary; adding those concerns directly to the library candidate would collapse State / Checkpoint, Policy / Approval, and product-domain ownership.
+The protected procedural-graph source is intentionally non-durable. A graph digest or successful held-out screen is not retained activation authority. Durable history, authenticated evaluation receipts, current-lifecycle revocation, approval CAS, canary state, rollback and recovery require a later owner-approved boundary; adding those concerns directly to the library aggregate would collapse State / Checkpoint, Policy / Approval, and product-domain ownership.
 
 ## 9. Standalone and modular MSA contract
 
@@ -159,7 +159,7 @@ The active procedural-graph candidate is intentionally non-durable. A graph dige
 | OIDC/GitHub App | issuer/audience/repository/workflow-ref, immutable workflow-source SHA when configured, malformed token/JWKS, replay, redirect/egress, secret non-disclosure regressions |
 | Durable Objects | cross-instance semantics, delayed/retried alarm, current-state reschedule, malformed backend/storage-failure tests |
 | External-extension lifecycle | legal-edge validation; restart/replay/CAS races; exact Policy / Approval and foreign-owner reference binding; corruption/truncation/cross-stream rejection; >128-transition auditability; O(1) verified current projection; full audit/recovery rehearsal; actual Durable Object p95/contention/storage-growth evidence before runtime acceptance |
-| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; later authenticated receipt/approval/canary evidence before activation |
+| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; fresh authenticated lifecycle snapshot on execution projection; later authenticated receipt/durable revocation/approval/canary evidence before activation |
 | GitHub Actions/control plane | least privilege, exact-head/live-base binding, full pagination, stale-head refusal, evidence-class separation |
 | LLM integration | gateway contract, provider-key isolation, deterministic gates independent of model judgement |
 | release/acquisition | protected source, CI/security/coverage, package/SBOM/provenance/reproducibility, licensing/NOTICE, rollback/recovery, later operational/buyer evidence |
@@ -172,7 +172,7 @@ Repository source/docs cannot fabricate stronger live `main` governance than the
 
 Candidate lifecycle source also cannot establish actual Durable Object p95, contention/partition behavior, backup/restore success, production recovery, or deployed invocation enforcement by documentation alone. Those remain later exact operational evidence.
 
-Candidate procedural-graph source cannot establish authenticated evaluation provenance, cross-language/released digest semantics, durable version history, approval, canary operation, rollback success, or production outcome improvement. Those remain later contract, Policy / Approval, operational, and product-owner evidence.
+Protected procedural-graph source cannot establish authenticated evaluation provenance, cross-language/released digest semantics, durable version history, current-lifecycle revocation, approval, canary operation, rollback success, or production outcome improvement. Those remain later contract, Policy / Approval, operational, and product-owner evidence.
 
 ## 12. Canonical documentation graph
 
@@ -197,6 +197,6 @@ The default shape is **small credential-exchange service + explicit state coordi
 
 The external-extension lifecycle remains a bounded Tool Capability / State / Checkpoint aggregate rather than a new scanner, quarantine runtime, egress engine, identity provider, or model router. Its synchronous projection path and full audit/recovery path are deliberately separate so buyer/runtime latency does not require scanning retained history while recovery still verifies the complete chain.
 
-The procedural-graph candidate remains a bounded Agent Runtime advisory aggregate rather than an execution engine or autonomous policy plane. It may select localized procedural context and screen a direct child candidate, but any future persistence, release, approval, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized: false` until those independent authorities are proven.
+The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. It may select localized procedural context and screen a direct child candidate, and its execution adapter may project that context only against a caller-supplied fresh authenticated `running` lifecycle snapshot. Any future persistence, release, approval, current-lifecycle revocation, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized: false` until those independent authorities are proven.
 
-Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth.
+Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth.