From 108459a1c088bd75ab2f575e965eb54ffc1f285c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 06:25:41 +0900 Subject: [PATCH 1/9] test(docs): require protected procedural response-bound authority --- ...ral-protected-documentation-contract.test.ts | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/test/procedural-protected-documentation-contract.test.ts b/test/procedural-protected-documentation-contract.test.ts index 9e174f831..611fa9fc0 100644 --- a/test/procedural-protected-documentation-contract.test.ts +++ b/test/procedural-protected-documentation-contract.test.ts @@ -25,6 +25,23 @@ describe("protected procedural documentation authority", () => { expect(adoption).toContain("#585, #586, and #589 are merged on protected `main`"); }); + it("records the protected current-state response bound without promoting deployment authority", () => { + const changelog = document("CHANGELOG.md"); + const adr = document("docs/adr/0017-procedural-graph-guidance.md"); + const baseline = document("docs/product-technical-gap-baseline.md"); + + expect(changelog).toContain("PR #652"); + expect(changelog).toContain("1 MiB retained-byte ceiling"); + expect(adr).toContain("Protected #652 bounds that private response to a 1 MiB retained-byte ceiling"); + expect(baseline).toContain("#603 + #652"); + expect(baseline).toContain("fixed 1 MiB retained buffer"); + + for (const currentDocument of [changelog, adr, baseline]) { + expect(currentDocument).toContain("ADR-0017").or.toContain("ADR 0017"); + expect(currentDocument).toContain("Proposed"); + } + }); + it("classifies durable procedural evaluation history as protected State / Checkpoint source", () => { const adoption = document("docs/doctoring/procedural_graph_adoption.md"); From 886d500b0de4bc9206b7c1a8d3a0d0620162006a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 06:25:59 +0900 Subject: [PATCH 2/9] test(docs): keep response-bound RED semantic --- test/procedural-protected-documentation-contract.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/procedural-protected-documentation-contract.test.ts b/test/procedural-protected-documentation-contract.test.ts index 611fa9fc0..81bee40b8 100644 --- a/test/procedural-protected-documentation-contract.test.ts +++ b/test/procedural-protected-documentation-contract.test.ts @@ -37,7 +37,7 @@ describe("protected procedural documentation authority", () => { expect(baseline).toContain("fixed 1 MiB retained buffer"); for (const currentDocument of [changelog, adr, baseline]) { - expect(currentDocument).toContain("ADR-0017").or.toContain("ADR 0017"); + expect(currentDocument).toMatch(/ADR-0017|ADR 0017/u); expect(currentDocument).toContain("Proposed"); } }); From 24338652141455120da0e96eb5f83abb530759e8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 06:27:20 +0900 Subject: [PATCH 3/9] test(docs): scope proposal status to canonical ADR docs --- test/procedural-protected-documentation-contract.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/procedural-protected-documentation-contract.test.ts b/test/procedural-protected-documentation-contract.test.ts index 81bee40b8..e6ad70433 100644 --- a/test/procedural-protected-documentation-contract.test.ts +++ b/test/procedural-protected-documentation-contract.test.ts @@ -36,7 +36,7 @@ describe("protected procedural documentation authority", () => { expect(baseline).toContain("#603 + #652"); expect(baseline).toContain("fixed 1 MiB retained buffer"); - for (const currentDocument of [changelog, adr, baseline]) { + for (const currentDocument of [adr, baseline]) { expect(currentDocument).toMatch(/ADR-0017|ADR 0017/u); expect(currentDocument).toContain("Proposed"); } From 43fd61b56538ac0ad06dcd87e3fdf0688ea1d684 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 06:36:06 +0900 Subject: [PATCH 4/9] docs(agent-runtime): record protected response bound --- CHANGELOG.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 53468fdc4..5837d4080 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required. ## Unreleased +- Agent Runtime의 workflow-backed procedural current-state ACL이 private Workflow / Task Execution Durable Object 응답을 `Response.json()`으로 선버퍼링하지 않고 고정 `Uint8Array`에 chunk-wise 수신해 **1 MiB retained-byte ceiling**을 적용한다. 한도를 넘는 chunk는 copy 전에 실패-폐쇄하고 stream cancellation failure가 안정적인 진단을 덮지 않으며 reader lock을 정리한다. Fatal UTF-8/JSON admission과 exact execution/plan/task 검증은 유지한다. 이 protected source는 immutable release, deployed Durable Object p95/recovery, graph publication 또는 activation authority를 대신하지 않는다. PR #652. - Distributed `/exchange` rate-limit의 private Durable Object request(256 bytes)와 decision response(4,096 bytes) bounded stream reader가 허용 chunk를 배열에 누적하지 않고 각 byte ceiling 크기의 고정 `Uint8Array`에 직접 복사하도록 바꾼다. 합법적인 high-fragmentation stream이 accepted-byte ceiling과 별개로 retained chunk object/backing-store 수와 두 번째 합산 allocation을 키우지 않으며 초과 chunk는 copy 전에 실패-폐쇄한다. 기존 cancellation, fatal UTF-8·duplicate-key·JSON admission, bucket/identity/Durable Object authority는 유지한다. 이 source hardening은 immutable release나 deployed heap/p95 evidence를 대신하지 않는다. PR #650. - Base credential-exchange의 OIDC discovery/JWKS·GitHub API bounded JSON response reader가 허용 chunk를 배열에 누적하지 않고 65,536-byte 고정 버퍼에 직접 복사하도록 바꾼다. Stream fragmentation이 accepted-byte ceiling과 별개로 retained chunk object/backing-store 수와 두 번째 합산 allocation을 키우지 않으며, 초과 chunk는 복사 전에 실패-폐쇄한다. 기존 10초 wall-clock deadline, cancellation, fatal UTF-8·duplicate-key·JSON admission, OIDC/GitHub identity·credential authority는 유지한다. 이 source hardening은 immutable release나 production p95/heap evidence를 대신하지 않는다. PR #646. - Workflow registry disable/plan 운영 경로의 GitHub JSON 응답 reader도 고정 `Uint8Array(MAX_RESPONSE_BYTES)`에 직접 수신해 합법적인 고분할 stream이 chunk-object retention과 두 번째 합산 allocation을 키우지 않도록 한다. Oversize는 copy 전에 실패-폐쇄하며 기존 pagination·registry identity·single-workflow disable authority는 유지한다. 이 source hardening은 live registry cleanliness나 immutable release evidence를 대신하지 않는다. PR #645. @@ -88,7 +89,7 @@ - `/exchange`의 권한 발급 전 abuse-control을 Worker isolate별 메모리 맵에서 SQLite-backed Durable Object의 전역 고정-window 결정으로 강화. `CF-Connecting-IP`만 신뢰하고 SHA-256 bucket 이름으로 개인정보 노출을 줄이며, transactional storage·alarm cleanup·429/Retry-After·분산 limit headers를 제공하고 binding/응답 이상은 503으로 실패-폐쇄. 기존 isolate-local limiter는 defense in depth로 유지. - production 배포 증빙을 acquisition final gate에 연결. 선택된 release tag·commit·production Worker·100% traffic·immutable release·strict KPI·smoke·independent environment reviewer·Sigstore signer/OIDC/runner policy·deployment receipt SHA-256을 교차 검증하는 `acquisition:deployment-evidence`를 추가하고, 배포 attestation 검증 성공 후 생성되는 verification receipt와 governance report를 buyer data room 필수 evidence로 색인. - immutable release publication receipt의 입력·출력 parent 경로를 실제 directory/non-symlink inode chain으로 재검증하고, 승인된 출력 directory에 owner-only 새 파일을 exclusive no-follow descriptor로 한 번만 생성한다. 작성 뒤 descriptor/path/초기 parent identity를 다시 검증해 stable parent replacement, 기존 receipt 교체와 symlink 전환을 실패-폐쇄한다. 실패한 write나 close는 가능한 경우 열린 descriptor로 truncate하며 cleanup 실패는 운영자 제거가 필요하다고 명시한다. Node에 dirfd-relative open이 없으므로 concurrent same-user ancestor replacement는 protected-runner filesystem trust boundary 밖이다. -- GitHub `production` environment의 live protection rules를 배포 전에 감사하는 `production:governance` 게이트를 추가. 구체적인 User/Team required reviewer, self-review 금지, branch-policy rule, protected-branch-only 정책을 검증하고 `main`에서 dispatch되지 않았거나 환경 설정이 약화되면 Cloudflare credential 사용 전에 실패-폐쇄하며, bounded governance JSON을 배포 증빙과 함께 365일 보존. +- GitHub `production` environment의 live protection rules를 배포 전에 감사하는 `production:governance` 게이트를 추가. 구체적인 User/Team required reviewer, self-review 금지, branch-policy rule, protected-branch-only 정책을 검증하고 `main`에서 dispatch되지 않았거나 환경 설정이 약화되면 Cloudflare credential 사용 전에 실패-폐쇄하며, bounded governance JSON을 배포 증빙과 함께 365일 보존한다. - production 배포를 임의 branch가 아닌 immutable SemVer GitHub Release에 결합하고, Wrangler structured output·Cloudflare pre/post deployment snapshot·strict 30일 KPI·post-deploy smoke를 검증해 active 100% opaque Worker version ID와 rollback identity를 기록하는 `deployment-evidence.json`을 추가. GitHub/Sigstore custom attestation을 자체 검증하고 release/KPI/smoke/rollback 증빙과 함께 365일 보존하며, tag·release manifest·Worker version·traffic·검증 상태가 불일치하면 실패-폐쇄. 실제 격리 환경이 없는 staging 선택지는 노출하지 않음. - exact-tag source archive·CycloneDX SBOM·checksum·Sigstore bundle을 immutable GitHub Release의 6개 고정 asset으로 게시하고 release/asset attestation을 모두 검증하는 격리 publication job 및 365일 acquisition receipt를 추가. immutable-release policy·tag/commit·asset digest/size가 불일치하거나 기존 release가 있으면 overwrite 없이 실패-폐쇄. - 정확한 SemVer tag/commit에 결합된 source archive, lockfile 기반 CycloneDX 1.5 SBOM, SHA-256 manifest, GitHub Actions provenance/SBOM attestation을 생성·자체 검증하는 `release-evidence` 공급망 게이트를 추가. buyer는 online 또는 air-gapped 환경에서 signer workflow·source/signer digest·tag ref·Actions OIDC issuer·GitHub-hosted runner 정책을 강제해 증빙을 검증할 수 있음. @@ -118,5 +119,3 @@ - installation token이 포함되는 `/exchange` 응답에 `Cache-Control: no-store`, `Pragma: no-cache`, `X-Content-Type-Options: nosniff` 보안 헤더를 추가하고 회귀 테스트로 고정. - 배포 스모크가 `/health`와 `/exchange`의 no-store/nosniff 보안 헤더 및 `/exchange` 401 Bearer challenge까지 검증하도록 `smoke-readiness.sh`와 회귀 테스트를 보강. - `/exchange` 401 응답에 `WWW-Authenticate: Bearer realm="noema"` challenge를 추가하고 인증 누락은 `invalid_request`, 잘못된 토큰은 `invalid_token`으로 구분. -- `x-request-id`/`x-correlation-id` 및 client IP 계열 헤더를 길이/문자 기준으로 제한해 로그 오염과 rate-limit key 폭주를 방지. -- `KRW 2,000,000,000` 매각 가능성 Goal 등록서, buyer due diligence index, library/submodule 경계 판단서를 추가하고 `npm run acquisition:audit`로 ARR/LOI/이전성/saleable evidence를 실패-폐쇄 방식으로 검증. \ No newline at end of file From 80aa341a81a0603cca7357d3fde515840c6755a4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 06:37:05 +0900 Subject: [PATCH 5/9] docs(agent-runtime): converge procedural response authority --- docs/product-technical-gap-baseline.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 4ac6a95ae..d16ed1d71 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,11 +4,11 @@ 이 문서는 protected source, active candidate, transient workflow evidence와 foreign-owner authority를 분리한다. Open PR exact head, protected base, required workflow, review thread, release와 central dependency는 mutation·merge·release 직전에 다시 읽는다. predecessor GREEN, queued/pending/in_progress/skipped/cancelled run, 오래된 PR base snapshot과 scanner/model judgement는 다음 revision의 merge authority로 전용하지 않는다. queued는 GREEN이 아니다. -Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@65e8bb7acd34d334d811fae3eee8918de258900d`이다. #650의 GitHub-verified normal merge identity `65e8bb7acd34d334d811fae3eee8918de258900d`는 protected history에 포함되며, 이후 protected-main 전진을 이 문서의 evergreen authority로 전용하지 않는다. +Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@ac762f118021c8eb2cba16563722ed83c0fd3437`이다. #652의 GitHub-verified normal merge identity `ac762f118021c8eb2cba16563722ed83c0fd3437`는 protected history에 포함되며, 이후 protected-main 전진을 이 문서의 evergreen authority로 전용하지 않는다. Dated central control-plane observation for this repair는 central `.github/main@cb0872c9a20d5584703dffacca65c096fc034c6c`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. -Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`, merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`, documentation-authority integration #583, protected procedural graph source #585/#586, documentation convergence #587/#588/#590/#595, workflow-backed current-state integration #589, procedural decision/evaluation/authentication integrations #591/#592/#593/#594/#596, State / Checkpoint history #597, Policy / Approval CAS #601, publication preflight #603, Workflow / Task exact-object operability integration #605, documentation-authority convergence #606, merged PR #607 exact `0afd68d2e33b7fd9be2307ba78b370b534cc0f54`, merged PR #610 exact `0a516bc54d682817ffea3206ec8b24b214aa94ea`, merged PR #612 exact `a919be3bc2a04068e25a4592e0c9c26f8e63534b`, merged PR #614 exact `77c5116a2e58e8a154ee893a3825da19c9c1f357`, merged PR #616 exact `da8461f1f5a6d02d926dd295fc88abe2c6167dfa`, documentation-authority convergence PR #617 exact `38b3b56837d875d19ae458f3f5491951ad7afb1c`, merged PR #618 exact `fb166ec6ecc769a19fd4ae4502f6d0994fc89e33`, merged PR #620 exact `b746846e4890c84b568bb29937594e1b17364fa1`, documentation-authority convergence #639, merged PR #640 exact `72ff4897822b5a8122540509346be4f3278a1379`, merged PR #641 exact `73f13b3a3826c5d6f7aafc89d1ff23747f8cf8e9`, merged PR #642 exact `3427e5a66d7a0ea9379ddc7915ba2b3d1872c492`, merged PR #643 exact `b13903e3208232086871d7f117f8f20e753eb583`, merged PR #644 exact `79a89f5775d0fb56de9f1908c1927df0b498b70f`, merged PR #645 exact `1b4dc38581e99b92342769dd03059f5015ee9f04`, merged PR #646 exact `3005086fca2c6376fae951b774230fa1c06ba587`, merged PR #647 exact `ea3a36bc65df88153aa69a05e3144f0b5352b5a6`, merged PR #648 exact `133ce20c4bb7fb9ba05e3e4bedeb0492334faf38`, merged PR #649 exact `f334f40193da8811a6e15efcb2d589aa80104931`, 그리고 merged PR #650 exact `f59fce008a4da70f89e9927f692b823506594ed5`가 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. +Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`, merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`, documentation-authority integration #583, protected procedural graph source #585/#586, documentation convergence #587/#588/#590/#595, workflow-backed current-state integration #589, procedural decision/evaluation/authentication integrations #591/#592/#593/#594/#596, State / Checkpoint history #597, Policy / Approval CAS #601, publication preflight #603, Workflow / Task exact-object operability integration #605, documentation-authority convergence #606, merged PR #607 exact `0afd68d2e33b7fd9be2307ba78b370b534cc0f54`, merged PR #610 exact `0a516bc54d682817ffea3206ec8b24b214aa94ea`, merged PR #612 exact `a919be3bc2a04068e25a4592e0c9c26f8e63534b`, merged PR #614 exact `77c5116a2e58e8a154ee893a3825da19c9c1f357`, merged PR #616 exact `da8461f1f5a6d02d926dd295fc88abe2c6167dfa`, documentation-authority convergence PR #617 exact `38b3b56837d875d19ae458f3f5491951ad7afb1c`, merged PR #618 exact `fb166ec6ecc769a19fd4ae4502f6d0994fc89e33`, merged PR #620 exact `b746846e4890c84b568bb29937594e1b17364fa1`, documentation-authority convergence #639, merged PR #640 exact `72ff4897822b5a8122540509346be4f3278a1379`, merged PR #641 exact `73f13b3a3826c5d6f7aafc89d1ff23747f8cf8e9`, merged PR #642 exact `3427e5a66d7a0ea9379ddc7915ba2b3d1872c492`, merged PR #643 exact `b13903e3208232086871d7f117f8f20e753eb583`, merged PR #644 exact `79a89f5775d0fb56de9f1908c1927df0b498b70f`, merged PR #645 exact `1b4dc38581e99b92342769dd03059f5015ee9f04`, merged PR #646 exact `3005086fca2c6376fae951b774230fa1c06ba587`, merged PR #647 exact `ea3a36bc65df88153aa69a05e3144f0b5352b5a6`, merged PR #648 exact `133ce20c4bb7fb9ba05e3e4bedeb0492334faf38`, merged PR #649 exact `f334f40193da8811a6e15efcb2d589aa80104931`, merged PR #650 exact `f59fce008a4da70f89e9927f692b823506594ed5`, documentation-authority convergence #651, 그리고 merged PR #652 exact `23fabd95f3ef886c6bef0ae9ff6ead50dc0ce342`가 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. 이 baseline과 executable documentation-authority test는 active documentation-authority lane 하나만 write한다. mutation 직전 open PR/Issue/branch를 fresh-read해 writer를 결정하며 merged/closed historical PR 번호를 active sole writer로 고정하지 않는다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다. @@ -20,7 +20,7 @@ Noema Core Domain은 Agent Runtime과 Workflow / Task Execution이다. Tool / Ca Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. ADR 0018도 `Proposed`이며 protected #612/#614/#616/#618/#620 source는 recovery command semantics, provider-state verification, bounded Cloudflare control-plane response transport와 retained-heap bound를 보호하지만 controlled production recovery rehearsal, immutable release, SLO 또는 production outcome의 증거가 아니다. -Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics를 구현했고 protected #585/#586/#589 lineage는 기존 Workflow / Task Execution authority를 current-state ACL로 재사용한다. Protected #597은 bounded durable evaluation/rejection history를 기존 State / Checkpoint에 추가했고 #601은 별도 Noema Policy / Approval CAS를 추가했다. Protected #603 publication preflight는 current State / Checkpoint와 Policy / Approval을 안정적인 double-read window에서 다시 읽고 exact graph/history/evaluator/signer/approval identity를 결합하지만 `publicationAuthorized:false`와 `activationAuthorized:false`를 유지한다. 실제 graph publication, current non-workflow lifecycle/revocation, live Keyverse/owner signer trust, released wire contract, deployed evidence, canary/rollback과 product outcome은 별도 authority다. +Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics를 구현했고 protected #585/#586/#589 lineage는 기존 Workflow / Task Execution authority를 current-state ACL로 재사용한다. Protected #603 + #652 lineage에서 #603 publication preflight는 current State / Checkpoint와 Policy / Approval을 안정적인 double-read window에서 다시 읽고 exact graph/history/evaluator/signer/approval identity를 결합하고, #652는 그 Agent Runtime current-state ACL의 private Workflow / Task Execution response를 **fixed 1 MiB retained buffer**로 제한한다. Oversize는 copy 전에 실패-폐쇄하고 이 transport hardening은 lifecycle, publication 또는 activation authority를 추가하지 않는다. Protected #597은 bounded durable evaluation/rejection history를 기존 State / Checkpoint에 추가했고 #601은 별도 Noema Policy / Approval CAS를 추가했다. #603 preflight는 `publicationAuthorized:false`와 `activationAuthorized:false`를 유지한다. 실제 graph publication, current non-workflow lifecycle/revocation, live Keyverse/owner signer trust, released wire contract, deployed p95/recovery evidence, canary/rollback과 product outcome은 별도 authority다. ## Integrated exact-claim evidence — issue #555 / merged PRs #556 + #607 @@ -44,11 +44,11 @@ Protected source는 append-only external-extension lifecycle ledger, CAS/idempot Status는 **production activation adapter + deployed operability/recovery/release evidence open**이다. Actual deployed SQLite Durable Object에서 realistic read/contended-append denominator, exactly-one-winner CAS, >128-event continuity, malformed/truncated-state rejection, exact-object storage growth, p95 ≤20 ms where synchronous, PITR/equivalent recovery 및 immutable deployment/release provenance가 필요하다. -## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589 + #597 + #601 + #603 +## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589 + #597 + #601 + #603 + #652 -Protected source는 immutable bounded procedural graph/session admission, deterministic traversal, explicit abstention, workflow-backed current-state ACL, paired evaluation identity, authenticated signed evaluator handoff, bounded durable evaluation/rejection history, Noema Policy / Approval CAS와 #603 publication preflight를 포함한다. #601 approval/revocation event와 #603 preflight receipt는 모두 `activationAuthorized:false`이며 preflight는 `publicationAuthorized:false`다. ADR 0017도 `Proposed`다. +Protected source는 immutable bounded procedural graph/session admission, deterministic traversal, explicit abstention, workflow-backed current-state ACL, paired evaluation identity, authenticated signed evaluator handoff, bounded durable evaluation/rejection history, Noema Policy / Approval CAS와 #603 publication preflight를 포함한다. #652는 current-state ACL의 private Workflow / Task response를 1 MiB fixed retained buffer로 bounded-read하도록 harden하며 foreign Workflow / Task truth를 복제하지 않는다. #601 approval/revocation event와 #603 preflight receipt는 모두 `activationAuthorized:false`이며 preflight는 `publicationAuthorized:false`다. ADR 0017도 `Proposed`다. -Released procedural graph schema는 `context-graph-contracts`, signer trust와 key custody는 Keyverse/owner, provider routing은 `contextual-orchestrator`, product outcome은 consumer product owner가 소유한다. Noema는 실제 graph publication transaction, immutable release, live trust/lifecycle authority와 matched canary evidence 없이 publication/activation을 주장하지 않는다. +Released procedural graph schema는 `context-graph-contracts`, signer trust와 key custody는 Keyverse/owner, provider routing은 `contextual-orchestrator`, product outcome은 consumer product owner가 소유한다. Noema는 실제 graph publication transaction, immutable release, live trust/lifecycle authority, deployed Durable Object p95/recovery와 matched canary evidence 없이 publication/activation을 주장하지 않는다. ## Protected Workflow / Task operability source — issue #541 / merged PR #605 @@ -97,7 +97,7 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge | P0 | Production deployment recovery authority | split traffic/foreign Worker/stale deployment receipt, oversized provider response 또는 fragmented-stream heap amplification이 복구 제어면의 권위·자원을 왜곡할 위험 | protected #610 + #612 + #614 + #616 + #618 + #620 / issue #611 | source integrated; controlled rehearsal/release evidence open | immutable reviewed release + controlled recovery rehearsal + provider pre/post distribution + smoke/KPI + immutable recovery receipt | immutable reviewed release 이후 actual owner-controlled recovery rehearsal과 immutable evidence 검증 | | P0 | Exact-claim evidence supply chain | producer evidence 없는 tool/research claim이 reviewer authority가 될 위험 | protected #556 + #607 + issue #555 | generic source + protected #607 adapter integrated; live execution/research producer handoff, release and consumer open | `#2086` immutable execution framing + `#2087` immutable trusted retrieval producer + exact Noema adapter wiring + immutable Noema release + released central consumer | #2086/#2087 immutable producer contracts 후 narrow adapter wiring TDD; mutable consumer bump 금지 | | P0 | External extension lifecycle evidence | stale/revoked foreign authority 또는 local lifecycle source가 production truth로 오인될 위험 | protected #574–#582 + issue #561 | production activation adapter + deployed operability/recovery/release evidence open | immutable owner refs + Noema approval + deployed p95/contention/storage/recovery | immutable owner evidence 준비 뒤 fail-closed adapter 검증 | -| P0 | Procedural graph publication boundary | advisory/evaluation/preflight가 publication/activation으로 오인될 위험 | protected #585/#586/#589/#597/#601/#603 + issue #584 | source integrated; publication/activation unavailable | released graph contract + live signer trust + lifecycle/revocation + deployed evidence + graph publication/canary | prerequisites 전 graph publication fail closed 유지 | +| P0 | Procedural graph publication boundary | advisory/evaluation/preflight가 publication/activation으로 오인될 위험 | protected #585/#586/#589/#597/#601/#603/#652 + issue #584 | source integrated; response-bound hardening integrated; publication/activation unavailable | released graph contract + live signer trust + lifecycle/revocation + deployed evidence + graph publication/canary | prerequisites 전 graph publication fail closed 유지 | | P0 | Durable workflow/state production evidence | source Durable Object logic·object-size observation이 deployed recovery/SLO로 오인될 위험 | protected #542 + #605 / ADR 0013 / issue #541 | source + exact-object observation integrated; ADR 0013 Proposed | immutable release/deployment + exact-object transaction/restart/recovery + representative storage-growth denominator + p95 + PITR/rollback | approved deployment owner에서 exact protected release 대상으로 runtime/recovery receipt 확보 | | P0 | Protected-main governance closure | Security workflow 하나로 PR/review/history/deletion/bypass 통제를 과대 주장할 위험 | issue #27 | external control evidence open | live ruleset + PR/review/conversation/history/deletion + bypass evidence | admin/owner control을 독립 검증 | | P0 | Patch-validator operational publication | PR image CI가 immutable runtime publication으로 오인될 위험 | issue #66 | source/image integrated; publication open | protected-main execution + immutable image/signature/SBOM/provenance/rollback | operational receipt 뒤 publication/signing 검증 | From 6b2f68f1474895c6282b4e92850d4c818016dc4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 06:37:45 +0900 Subject: [PATCH 6/9] docs(agent-runtime): classify protected current-state bound --- docs/adr/0017-procedural-graph-guidance.md | 38 ++++++++++++++-------- 1 file changed, 24 insertions(+), 14 deletions(-) diff --git a/docs/adr/0017-procedural-graph-guidance.md b/docs/adr/0017-procedural-graph-guidance.md index 40a3e8d86..0500fb76e 100644 --- a/docs/adr/0017-procedural-graph-guidance.md +++ b/docs/adr/0017-procedural-graph-guidance.md @@ -71,6 +71,14 @@ execution-scoped private `read` command instead of accepting a cached caller-own task identities, canonical task states, cancellation identity, and monotonic transition sequence or the ACL fails closed. +Protected #652 bounds that private response to a 1 MiB retained-byte ceiling with a +fixed `Uint8Array` and chunk-wise pre-copy admission before JSON parsing. Oversize or +malformed chunks, body-stream failure, invalid UTF-8/JSON and absent bodies fail closed; +reader cancellation failure cannot replace the stable domain diagnostic and the lock +is released. This transport hardening does not move Workflow / Task Execution truth +into Agent Runtime, add lifecycle transitions, or prove deployed Durable Object +latency, restart, recovery, heap, or release behavior. + That durable read does **not** move Agent Runtime lifecycle truth into Workflow / Task Execution. It derives only a conservative guidance projection: current cancellation evidence suppresses advice; a fully terminal task vector suppresses @@ -162,7 +170,7 @@ must separately honor current revocation. Keyverse/owner retains signer identity key custody; graph publication, released cross-service contracts, canary/rollback and product-owner outcome evidence remain outside this boundary. -Candidate #603 adds a publication-time preflight under Noema Policy / Approval. It +Protected #603 adds a publication-time preflight under Noema Policy / Approval. It freshly reads the existing State / Checkpoint history and Policy / Approval ledger twice, rejects movement inside that stable-read window, rejects a current revocation, and requires the exact candidate/history/evaluator-handoff/signer/approval identity @@ -173,15 +181,15 @@ precondition evidence only and does not publish or activate a graph. A later pub must atomically/CAS-bind the exact receipt to its own operation plus immutable released external graph-contract and signer-trust inputs. Existing execution lifecycle and cancellation authority stay in Agent Runtime and Workflow / Task Execution rather than -becoming graph-publication truth. ADR-0017 remains `Proposed` while #603 is candidate -source and after source integration until release/deployment/shadow/canary evidence -satisfies the separate acceptance boundaries. +becoming graph-publication truth. ADR-0017 remains `Proposed` after #603 and #652 source +integration until release/deployment/shadow/canary evidence satisfies the separate +acceptance boundaries. ## CWL ownership and rollout | Owner | Planned responsibility; not a claim of deployed integration | | --- | --- | -| Noema | Graph snapshot, guidance context, offline screening, signed evaluator-handoff verification, workflow-backed current-state guidance ACL, bounded State / Checkpoint evaluation/rejection history, provenance-preserving history reads, protected #601 Policy / Approval CAS, and candidate #603 publication-time preflight; graph publication/activation remains separate work | +| Noema | Graph snapshot, guidance context, offline screening, signed evaluator-handoff verification, workflow-backed current-state guidance ACL with protected #652 response bound, bounded State / Checkpoint evaluation/rejection history, provenance-preserving history reads, protected #601 Policy / Approval CAS, and protected #603 publication-time preflight; graph publication/activation remains separate work | | context-graph-contracts | Released language-neutral schemas, digest rules, conformance fixtures | | enterprise-architecture-core | Capability/owner map, versioned adoption matrix and evidence classes | | contextual-orchestrator | Existing gateway routing for later guide/solver/refiner calls; no client-side provider fallback | @@ -193,7 +201,7 @@ satisfies the separate acceptance boundaries. | .github and product owners | Central development profile and product-specific procedural graphs/adapters/tests | 1. Keep the deterministic core, workflow-backed current-state ACL, authenticated - evaluator handoff, durable evidence history, Policy / Approval ledger, and candidate + evaluator handoff, durable evidence history, Policy / Approval ledger, and protected publication preflight advisory/evidence-only; none grants activation. 2. Have contract/EAC owners release interoperable schemas and ownership records. Do not consume mutable sibling PR heads or independently copy this runtime. @@ -203,7 +211,7 @@ satisfies the separate acceptance boundaries. duplicate effects, tokens/cost, and latency separately; do not invent gains. 4. Reuse protected signed evaluator verification, State / Checkpoint durable rejection history, verified snapshot provenance, and #601 Policy / Approval CAS as prerequisites. - Candidate #603 adds fresh cross-authority reconciliation; sanitized trajectory + Protected #603 adds fresh cross-authority reconciliation; sanitized trajectory extraction, offline candidate generation, actual graph publication and recovery remain separate work and must not create duplicate truth. 5. Enable opt-in canaries for other products only after their own conformance and @@ -225,21 +233,23 @@ production caller integration, or organization-wide deployment is implied. The workflow-backed ACL closes only the caller-cache replay path when the current Workflow / Task Execution Durable Object itself contains newer cancellation or -terminal task evidence. It is not a universal Agent Runtime lifecycle database and -must not be advertised as one. Real runtime acceptance requires exact deployed +terminal task evidence. Protected #652 additionally bounds the private owner response +before JSON admission; neither change is a universal Agent Runtime lifecycle database +or deployed performance/recovery proof. Real runtime acceptance requires exact deployed composition plus failure/restart and buyer-path latency evidence; the p95 <=20 ms target is measured against the deployed path rather than inferred from unit tests. There is still no production graph publication/trajectory store, automatic refiner, -product invocation, or activation composition. Candidate #603 adds the missing +product invocation, or activation composition. Protected #603 adds the missing publication-time State / Checkpoint + Policy / Approval reconciliation preflight, but that preflight is deliberately not an atomic publisher and carries no publication or activation authority. Protected #594 provides signed evaluator-handoff verification, #597 provides bounded durable evaluation/rejection history, #599 provides repository- -verified read provenance, and #601 provides the Policy / Approval CAS ledger; none of -those source slices, nor candidate #603, is release, deployment, graph publication, -or activation authority. There is also no evidence yet that graph guidance improves -CWL tasks. The owning root product/technical baseline must retain these gaps without +verified read provenance, #601 provides the Policy / Approval CAS ledger, and #652 +bounds the private current Workflow / Task response retained before Agent Runtime +admission; none of those source slices is release, deployment, graph publication, or +activation authority. There is also no evidence yet that graph guidance improves CWL +tasks. The owning root product/technical baseline must retain these gaps without replacing historical results. Do not mark ADR-0017 Accepted, publish a release, or advertise organization-wide activation from source integration or tracking issues. From d6245a63616ca00e477965b429c738d1b6e22623 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 06:41:25 +0900 Subject: [PATCH 7/9] docs(changelog): preserve protected history --- CHANGELOG.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5837d4080..5bd820351 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -89,7 +89,7 @@ - `/exchange`의 권한 발급 전 abuse-control을 Worker isolate별 메모리 맵에서 SQLite-backed Durable Object의 전역 고정-window 결정으로 강화. `CF-Connecting-IP`만 신뢰하고 SHA-256 bucket 이름으로 개인정보 노출을 줄이며, transactional storage·alarm cleanup·429/Retry-After·분산 limit headers를 제공하고 binding/응답 이상은 503으로 실패-폐쇄. 기존 isolate-local limiter는 defense in depth로 유지. - production 배포 증빙을 acquisition final gate에 연결. 선택된 release tag·commit·production Worker·100% traffic·immutable release·strict KPI·smoke·independent environment reviewer·Sigstore signer/OIDC/runner policy·deployment receipt SHA-256을 교차 검증하는 `acquisition:deployment-evidence`를 추가하고, 배포 attestation 검증 성공 후 생성되는 verification receipt와 governance report를 buyer data room 필수 evidence로 색인. - immutable release publication receipt의 입력·출력 parent 경로를 실제 directory/non-symlink inode chain으로 재검증하고, 승인된 출력 directory에 owner-only 새 파일을 exclusive no-follow descriptor로 한 번만 생성한다. 작성 뒤 descriptor/path/초기 parent identity를 다시 검증해 stable parent replacement, 기존 receipt 교체와 symlink 전환을 실패-폐쇄한다. 실패한 write나 close는 가능한 경우 열린 descriptor로 truncate하며 cleanup 실패는 운영자 제거가 필요하다고 명시한다. Node에 dirfd-relative open이 없으므로 concurrent same-user ancestor replacement는 protected-runner filesystem trust boundary 밖이다. -- GitHub `production` environment의 live protection rules를 배포 전에 감사하는 `production:governance` 게이트를 추가. 구체적인 User/Team required reviewer, self-review 금지, branch-policy rule, protected-branch-only 정책을 검증하고 `main`에서 dispatch되지 않았거나 환경 설정이 약화되면 Cloudflare credential 사용 전에 실패-폐쇄하며, bounded governance JSON을 배포 증빙과 함께 365일 보존한다. +- GitHub `production` environment의 live protection rules를 배포 전에 감사하는 `production:governance` 게이트를 추가. 구체적인 User/Team required reviewer, self-review 금지, branch-policy rule, protected-branch-only 정책을 검증하고 `main`에서 dispatch되지 않았거나 환경 설정이 약화되면 Cloudflare credential 사용 전에 실패-폐쇄하며, bounded governance JSON을 배포 증빙과 함께 365일 보존. - production 배포를 임의 branch가 아닌 immutable SemVer GitHub Release에 결합하고, Wrangler structured output·Cloudflare pre/post deployment snapshot·strict 30일 KPI·post-deploy smoke를 검증해 active 100% opaque Worker version ID와 rollback identity를 기록하는 `deployment-evidence.json`을 추가. GitHub/Sigstore custom attestation을 자체 검증하고 release/KPI/smoke/rollback 증빙과 함께 365일 보존하며, tag·release manifest·Worker version·traffic·검증 상태가 불일치하면 실패-폐쇄. 실제 격리 환경이 없는 staging 선택지는 노출하지 않음. - exact-tag source archive·CycloneDX SBOM·checksum·Sigstore bundle을 immutable GitHub Release의 6개 고정 asset으로 게시하고 release/asset attestation을 모두 검증하는 격리 publication job 및 365일 acquisition receipt를 추가. immutable-release policy·tag/commit·asset digest/size가 불일치하거나 기존 release가 있으면 overwrite 없이 실패-폐쇄. - 정확한 SemVer tag/commit에 결합된 source archive, lockfile 기반 CycloneDX 1.5 SBOM, SHA-256 manifest, GitHub Actions provenance/SBOM attestation을 생성·자체 검증하는 `release-evidence` 공급망 게이트를 추가. buyer는 online 또는 air-gapped 환경에서 signer workflow·source/signer digest·tag ref·Actions OIDC issuer·GitHub-hosted runner 정책을 강제해 증빙을 검증할 수 있음. @@ -119,3 +119,5 @@ - installation token이 포함되는 `/exchange` 응답에 `Cache-Control: no-store`, `Pragma: no-cache`, `X-Content-Type-Options: nosniff` 보안 헤더를 추가하고 회귀 테스트로 고정. - 배포 스모크가 `/health`와 `/exchange`의 no-store/nosniff 보안 헤더 및 `/exchange` 401 Bearer challenge까지 검증하도록 `smoke-readiness.sh`와 회귀 테스트를 보강. - `/exchange` 401 응답에 `WWW-Authenticate: Bearer realm="noema"` challenge를 추가하고 인증 누락은 `invalid_request`, 잘못된 토큰은 `invalid_token`으로 구분. +- `x-request-id`/`x-correlation-id` 및 client IP 계열 헤더를 길이/문자 기준으로 제한해 로그 오염과 rate-limit key 폭주를 방지. +- `KRW 2,000,000,000` 매각 가능성 Goal 등록서, buyer due diligence index, library/submodule 경계 판단서를 추가하고 `npm run acquisition:audit`로 ARR/LOI/이전성/saleable evidence를 실패-폐쇄 방식으로 검증. \ No newline at end of file From 09759a8e92f7cbac945655505924b9bfc035c8f3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 07:01:43 +0900 Subject: [PATCH 8/9] test(procedural): align #603 protected documentation authority --- test/procedural-publication-preflight-documentation.test.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/procedural-publication-preflight-documentation.test.ts b/test/procedural-publication-preflight-documentation.test.ts index 829247d22..e4f1cf5c4 100644 --- a/test/procedural-publication-preflight-documentation.test.ts +++ b/test/procedural-publication-preflight-documentation.test.ts @@ -4,8 +4,8 @@ import { describe, expect, it } from "vitest"; const adr = readFileSync("docs/adr/0017-procedural-graph-guidance.md", "utf8"); describe("procedural publication preflight documentation authority", () => { - it("classifies #603 as candidate preflight rather than publication or activation authority", () => { - expect(adr).toContain("Candidate #603 adds a publication-time preflight"); + it("classifies #603 as protected preflight without granting publication or activation authority", () => { + expect(adr).toContain("Protected #603 adds a publication-time preflight"); expect(adr).toContain("publicationAuthorized: false"); expect(adr).toContain("activationAuthorized: false"); expect(adr).toContain("does not publish or activate a graph"); From 41ff085c89e27a97a00ce85ced968931f506a147 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 12 Sep 2026 07:08:12 +0900 Subject: [PATCH 9/9] test(docs): keep #650 retention history non-evergreen --- test/documentation-retention-hardening-current.test.ts | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/test/documentation-retention-hardening-current.test.ts b/test/documentation-retention-hardening-current.test.ts index 61d806c34..8174fde71 100644 --- a/test/documentation-retention-hardening-current.test.ts +++ b/test/documentation-retention-hardening-current.test.ts @@ -2,12 +2,9 @@ import { readFileSync } from "node:fs"; import { describe, expect, it } from "vitest"; describe("protected retention-hardening documentation authority", () => { - it("keeps the moving product/technical baseline current through merged #650 without promoting source to runtime evidence", () => { + it("preserves merged #650 retention-hardening history after later protected-main advancement", () => { const baseline = readFileSync("docs/product-technical-gap-baseline.md", "utf8"); - expect(baseline).toContain( - "main@65e8bb7acd34d334d811fae3eee8918de258900d", - ); expect(baseline).toContain( "merged PR #642 exact `3427e5a66d7a0ea9379ddc7915ba2b3d1872c492`", );