feat(agent-runtime): gate procedural guidance on current durable workflow evidence

docs/adr/0017-procedural-graph-guidance.md

@@ -1,7 +1,7 @@
 # ADR-0017: Advisory procedural graphs with offline candidate screening
 
-Status: Proposed. A source implementation on a feature branch is not protected-source,
-release, or deployment acceptance.
+Status: Proposed. Individual source slices are protected only when present on protected `main`;
+this ADR status does not imply release, deployment, shadow, canary, or activation acceptance.
 
 Date: 2026-09-10
 
@@ -30,7 +30,8 @@ to an execution ID and exact graph digest. `procedural-evolution.ts` screens sup
 paired evaluation evidence. `procedural-input.ts` shares only strict data readers and
 content hashing inside this aggregate; it is not a generic organization utility.
 No HTTP route, `/exchange` change, OIDC trust expansion, persistence binding,
-provider client, credential, package dependency, or workflow is introduced.
+provider client, credential, package dependency, or workflow is introduced by the
+core graph slice.
 
 The local schema is `noema.procedural-graph/v1`, not a released CWL wire contract.
 Nodes have canonical identifiers, including `Start`. Directed edges carry `from`,
@@ -59,6 +60,28 @@ an exceeded edge budget produce an empty `abstain` result rather than the paper'
 full-graph fallback or a silently truncated prerequisite set. This intentional
 CWL adaptation needs comparison in the shadow pilot.
 
+`procedural-execution.ts` is the pure Agent Runtime gate: a locally admitted session
+receives advice only when a caller supplies fresh authenticated lifecycle state for
+the same canonical execution. It intentionally owns no durable lifecycle storage.
+For workflow-backed executions, `procedural-current-lifecycle.ts` adds a narrow
+anti-corruption/current-state ACL over the existing `NOEMA_WORKFLOW_STATE` owner.
+Every guidance decision re-admits the exact workflow plan and performs the existing
+execution-scoped private `read` command instead of accepting a cached caller-owned
+`running` snapshot. The response must match execution ID, plan ID, complete unique
+task identities, canonical task states, cancellation identity, and monotonic
+transition sequence or the ACL fails closed.
+
+That durable read does **not** move Agent Runtime lifecycle truth into Workflow /
+Task Execution. It derives only a conservative guidance projection: current
+cancellation evidence suppresses advice; a fully terminal task vector suppresses
+advice; an initialized all-pending vector with no later transition evidence remains
+pre-start; other nonterminal workflow evidence is eligible to pass through the
+existing running-only procedural gate. The projection cannot create lifecycle
+transitions, task claims, retries, tool capability, approval, publication, or
+activation. Non-workflow Agent Runtime executions still require their own fresh
+authenticated lifecycle source, and source tests do not prove deployed Durable
+Object latency, availability, restart behavior, or caller composition.
+
 Every context says `authority: advisory_only`. Text may still contain hostile
 instructions or sensitive content; this module is neither a prompt-injection
 classifier nor a secret/PII scrubber. Admission, minimization, taint handling,
@@ -110,7 +133,7 @@ Existing executions must keep their pinned revision and separately honor revocat
 
 | Owner | Planned responsibility; not a claim of deployed integration |
 | --- | --- |
-| Noema | Graph snapshot, guidance context, offline screening; later lifecycle/state adapters |
+| Noema | Graph snapshot, guidance context, offline screening, and workflow-backed current-state guidance ACL; durable graph/rejection history and promotion/revocation remain separate work |
 | context-graph-contracts | Released language-neutral schemas, digest rules, conformance fixtures |
 | enterprise-architecture-core | Capability/owner map, versioned adoption matrix and evidence classes |
 | contextual-orchestrator | Existing gateway routing for later guide/solver/refiner calls; no client-side provider fallback |
@@ -121,7 +144,7 @@ Existing executions must keep their pinned revision and separately honor revocat
 | psychometrics-commons / evaluation owner | Task-specific measures, rubric and standard-setting separation, held-out protocol and uncertainty |
 | .github and product owners | Central development profile and product-specific procedural graphs/adapters/tests |
 
-1. Implement and review this deterministic core without enabling a production path.
+1. Keep the deterministic core and workflow-backed current-state ACL advisory-only.
 2. Have contract/EAC owners release interoperable schemas and ownership records.
    Do not consume mutable sibling PR heads or independently copy this runtime.
 3. Integrate read-only shadow guidance through the existing orchestrator boundary
@@ -137,15 +160,42 @@ Existing executions must keep their pinned revision and separately honor revocat
 Do not force this pattern into deterministic numerical kernels or create another
 central scheduler. Source adoption, shadow use, canary, active deployment, and
 rollback-tested operation must appear as separate states in the adoption matrix.
-The active documentation lane may reconcile the ADR index and PRD/TRD/traceability
-without this lane overwriting its root baseline or historical evidence.
 
 ## Acceptance and remaining limitations
 
-The focused tests exercise the pure boundary; native repository typecheck,
-repository-wide exact coverage, inherited security checks, independent review,
-release artifacts, and deployed operational evidence remain distinct requirements.
-See the [implementation plan and verification record](../superpowers/plans/2026-09-10-procedural-graphs.md).
+The focused tests exercise the source boundary; native repository typecheck,
+repository-wide exact coverage, inherited security checks, review, release artifacts,
+and deployed operational evidence remain distinct requirements. See the
+[implementation plan and verification record](../superpowers/plans/2026-09-10-procedural-graphs.md).
 No automatic LLM refiner, signed graph store, guidance prompt, MCP endpoint,
-production caller integration, or organization-wide deployment is delivered by
-this first source slice.
+production caller integration, or organization-wide deployment is implied.
+
+The workflow-backed ACL closes only the caller-cache replay path when the current
+Workflow / Task Execution Durable Object itself contains newer cancellation or
+terminal task evidence. It is not a universal Agent Runtime lifecycle database and
+must not be advertised as one. Real runtime acceptance requires exact deployed
+composition plus failure/restart and buyer-path latency evidence; the p95 <=20 ms
+target is measured against the deployed path rather than inferred from unit tests.
+
+There is still no production graph/trajectory store, signed receipt verifier,
+automatic refiner, independently approved promotion API, or product invocation.
+There is also no evidence yet that graph guidance improves CWL tasks. The owning
+root product/technical baseline must retain these gaps without replacing historical
+results. Do not mark ADR-0017 Accepted, publish a release, or advertise
+organization-wide activation from source integration or tracking issues.
+
+## References
+
+Cloudflare. (2026). *Durable Object storage*. Cloudflare Developers.
+https://developers.cloudflare.com/durable-objects/api/storage-api/
+
+Cloudflare. (2026). *Invoke methods*. Cloudflare Developers.
+https://developers.cloudflare.com/durable-objects/best-practices/create-durable-object-stubs-and-send-requests/
+
+Lu, Y., Chen, Y., Wu, S., & Arık, S. Ö. (2026). *Procedural graphs: Self-evolving
+execution structures for LLM agents* [Preprint]. arXiv.
+https://doi.org/10.48550/arXiv.2609.09153
+
+코난쌤. (2026, September 10). *Procedural Graph: LLM 에이전트를 위한 자가진화
+절차 그래프 (arXiv 2609.09153) 논문 정리*. 코난쌤 블로그.
+https://conanssam.com/posts/2026-09-10-procedural-graphs-self-evolving-llm-agents

docs/doctoring/procedural_graph_adoption.md

@@ -13,7 +13,9 @@ The canonical EA adoption matrix belongs to enterprise-architecture-core, not th
 Protected source integration: #585 and #586 are merged on protected `main`.
 This is source-integration evidence only. ADR 0017 remains `Proposed`, candidate screening remains
 `activationAuthorized: false`, and release, deployment, authenticated evaluation, durable promotion,
-shadow/canary, rollback and product-outcome evidence remain separate authorities.
+shadow/canary, rollback and product-outcome evidence remain separate authorities. The workflow-backed
+current-state ACL is tracked in #589 until its own protected integration; this record does not promote
+a Draft head into protected or deployed truth.
 
 ## What the sources support
 
@@ -37,7 +39,7 @@ than the blog's interpretation or comparative scores.
 | Scope and identity | Graph tenant/task/digest are compared exactly. Execution IDs use Noema's existing `isCanonicalExecutionId`, not the narrower graph-node grammar. Graph identity and execution identity are different contracts. |
 | Local object admission | Only frozen graph sessions issued by the owning module may enter the lifecycle adapter. Copied objects, proxy wrappers and forged callbacks are rejected before session property access. This is local object integrity, not caller authentication. |
 | Unknown or oversized neighborhood | Return unavailable advice for `unknown_procedure` or `context_budget_exceeded`; do not turn abstention into success, return the entire graph, or silently drop prerequisite relationships. |
-| Execution lifecycle | Given fresh authenticated lifecycle state, only a running execution receives advice. Accepted, cancelling and terminal executions do not evaluate the neighborhood request. The pure adapter is not a durable revocation store and cannot detect replay of an old running snapshot. |
+| Execution lifecycle | The protected pure adapter accepts only a caller-supplied fresh authenticated lifecycle snapshot. For workflow-backed sessions, #589 adds a candidate ACL that re-reads the existing execution-scoped `NOEMA_WORKFLOW_STATE` owner before every guidance decision and suppresses advice when newer cancellation, terminal, or pre-start durable evidence exists. This is a conservative guidance projection, not a second Agent Runtime lifecycle store. |
 | Candidate comparison | Require exact base/candidate lineage, matching evaluation context, complete paired cases, disjoint train/holdout IDs and finite normalized scores. Reported candidate safety violations block eligibility regardless of mean gain. |
 | Independent acceptance | Arithmetic non-regression is not statistical significance, construct validity, standard setting or approval. Independent evaluation and final confirmation remain prerequisites. |
 | Data and secrets | No new credential, `.env` read, provider client, raw trajectory store or hidden-reasoning capture is introduced. Guidance text is still untrusted data; these modules do not detect prompt injection or scrub sensitive content. |
@@ -80,19 +82,28 @@ Protected source subsequently integrated #585 as merge commit
 `ae525cdc4ecc28e6caf5e5a45809f568388b3f7f`. #586 exact head
 `5351723f4ce3c2d41d463555986ba49e6c8f0f20` had terminal-success application CI,
 reviewer CI, central Security Scan and patch-validator-image before normal merge.
-These observations establish protected source integration; they do not establish an
+Those observations establish protected source integration; they do not establish an
 immutable release, deployed runtime behavior, graph effectiveness or rollout authority.
 
+#589 starts from the later protected documentation convergence and uses test-first
+`8565dd32c2111b1f06a91f36bd2d7928834b97e2` to require a fresh durable read for
+each workflow-backed guidance decision. The causal source reuses the private
+execution-scoped Workflow / Task Execution `read` command rather than adding another
+database or mutation endpoint. Its tests deliberately replay a first current response
+that permits advice followed by a newer cancellation response and require the second
+decision to suppress advice. Until #589 has unchanged exact-head hosted evidence and
+normal protected integration, that source remains candidate truth.
+
 ## Owner-led rollout and exit criteria
 
 | Stage | Responsible owner and concrete next delivery | Exit evidence |
 | --- | --- | --- |
-| Source readiness | Noema: keep the integrated #585/#586 core and lifecycle adapter aligned with canonical Agent Runtime boundaries while repairing code-current documentation drift. | Protected merge ancestry plus unchanged exact-head typecheck, full tests/coverage, applicable security/image checks and review; source integration is complete but does not satisfy later rollout stages. |
+| Source readiness | Noema: keep #585/#586 aligned and integrate the workflow-backed current-state ACL without crossing Workflow / Task or Agent Runtime ownership. | Protected ancestry plus unchanged exact-head typecheck, full tests/coverage, applicable security/image checks and review. |
 | Interchange release | context-graph-contracts #28: graph/context/evaluation/decision schema, digest semantics and hostile conformance fixtures. | Immutable released contract and compatible independent consumer fixtures. Local `noema.procedural-graph/v1` is not already that release. |
 | Ownership inventory | enterprise-architecture-core #50: task/profile owner, consumer port, contract pin, evaluation profile and rollback owner for each applicable product. | Evidence distinguishes proposed, source, released, shadow, canary, active and rollback-tested. Deterministic kernels may be not applicable with a recorded reason. |
 | First shadow connection | contextual-orchestrator #1116 plus .github and Naruon owners: connect guide/solver roles through the existing gateway without write-side activation. | Observed matched no-graph/fixed-graph/evolved-graph runs; task success, sequencing errors, duplicate effects, cost/tokens and latency reported separately. |
 | Independent evaluation | psychometrics-commons #447: task stimuli, item/rubric definitions, paired evidence protocol, validation-search and untouched final confirmation separation. | Authenticated producer and exact graph/model/tool/dataset/rubric/context binding; justified evidence size and uncertainty; independent acceptance. |
-| Offline state integration | Noema State/Checkpoint and Policy/Approval: minimized observations, candidate storage, scoped rejection retention, approval, compare-and-swap promotion, rollback and revocation. | Crash/replay/stale-writer tests and authentic approval/evidence references; running sessions keep their pinned revision and obey current revocation. |
+| Offline state integration | Noema State/Checkpoint and Policy/Approval: minimized observations, candidate storage, scoped rejection retention, approval, compare-and-swap promotion, rollback and revocation. Reuse existing execution/state authorities before adding persistence. | Crash/replay/stale-writer tests and authentic approval/evidence references; running sessions keep their pinned revision and obey current revocation. |
 | Product canary | Product owners: versioned adapter and domain-specific procedure/profile; no copied graph runtime. | Released contract conformance, observed invocation, domain regressions, independent side-effect controls and tested disable/rollback. |
 
 The first product scenarios are central review/finding verification and Naruon's
@@ -113,6 +124,14 @@ is necessary for this source slice.
 
 ## Remaining gaps that block active adoption
 
+The workflow-backed current-state ACL does not persist Agent Runtime lifecycle state
+and does not make Workflow / Task Execution the lifecycle owner. It only prevents a
+cached procedural `running` decision from surviving newer durable workflow evidence
+that proves cancellation, terminal work, or pre-start state. Non-workflow executions
+still need an authenticated current lifecycle source. The deployed Durable Object
+read path also still needs real runtime compatibility/restart evidence and buyer-path
+p95 measurement; source tests are not latency evidence.
+
 There is no production graph/trajectory store, signed receipt verifier, automatic
 refiner, independently approved promotion API or product invocation in protected
 source. There is also no evidence yet that graph guidance improves CWL tasks or meets
@@ -123,6 +142,12 @@ from source integration or the existence of tracking issues.
 
 ## References
 
+Cloudflare. (2026). *Durable Object storage*. Cloudflare Developers.
+https://developers.cloudflare.com/durable-objects/api/storage-api/
+
+Cloudflare. (2026). *Invoke methods*. Cloudflare Developers.
+https://developers.cloudflare.com/durable-objects/best-practices/create-durable-object-stubs-and-send-requests/
+
 Lu, Y., Chen, Y., Wu, S., & Arık, S. Ö. (2026). *Procedural graphs: Self-evolving
 execution structures for LLM agents* [Preprint]. arXiv.
 https://doi.org/10.48550/arXiv.2609.09153