feat(sandbox): restack patch-validator image on current main

CHANGELOG.md

@@ -8,6 +8,7 @@
 - strict production KPI provenance를 fail-closed로 강화한다. `collectedAt`은 canonical UTC 시각만 허용하고 미래·존재하지 않는 달력값을 거부하며, `records`는 coercion 없는 양의 safe-integer JSON number로 authenticated log record count와 일치해야 한다. production log는 `O_NOFOLLOW`로 연 verified regular-file descriptor의 identity·size·mode·mtime·ctime을 재검증하면서 동일 verified bytes로 snapshot을 생성해 symlink·pathname replacement·descriptor drift가 KPI authority를 제조하지 못하게 한다.
 - 인수 준비성 감사의 buyer/data-room 증거 경계를 실패-폐쇄로 강화한다. `updated_at`은 canonical ISO date 또는 timezone-bearing timestamp만 허용하고 존재하지 않는 달력값·비정규 형식·미래 시각을 거부하며, 명시된 evidence max-age 설정과 매출·고객·LOI·비율 지표는 coercion 없이 유효 도메인을 만족해야 한다. immutable release asset의 `bytes`도 실제 양의 safe-integer JSON number만 인정해 문자열·범위 밖 값이 매각 준비 증거를 제조하지 못하게 한다.
 - 루트 `README.md`를 구매자/운영자 표면으로 재작성한다. 제품 정의, 단독 실행, 호스트 호출(HTTP API·`contracts/orchestrator-gateway.json`), 운영 설정을 앞에 두고 naruon·곁(gyeot) 허브-리프 호출을 지원 경로로 문서화한다. CloudAgent/OpenCode 절차, PR 스택, exact-head CI, writer/agent 경계는 `CONTRIBUTING.md`와 `docs/development/contributor-and-agent-procedure.md`로 옮기며 삭제하지 않는다. `test/readme-customer-facing.test.ts`가 README에 봇 매뉴얼 잔여가 남지 않는지 고정한다.
+- repository-owned patch-validator image는 Node.js 24.19.0을 fully static으로 빌드한 `scratch` runtime을 사용하고, `process.versions` 기반 embedded dependency inventory, exact image SHA-256, CycloneDX/Syft/Grype/Trivy evidence, no-network/read-only/non-root smoke를 동일 exact-head receipt에 결합한다.
 - 비리뷰 LLM 작업인 `hourly-product-development`를 리뷰와 동일한 `contextual-orchestrator` 게이트웨이 계약(`NOEMA_LLM_API_URL` `/v1`, 모델 별칭 `contextual-orchestrator`, 전용 `NOEMA_LLM_API_KEY`)으로 전환한다. Llama Nemotron → Nemotron Super → DeepSeek 순차 NIM 후보 폴백과 `NVIDIA_NIM_API_KEY` 직접 호출을 제거하고, 공유 `scripts/verify-orchestrator-gateway.mjs`가 `/healthz` 신원과 직접 공급자 호스트를 실패-폐쇄한다. 리뷰어의 `NOEMA_FALLBACK_*` / PydanticAI `FallbackModel` 순차 폴백도 제거해 남은 설정은 실패-폐쇄한다. 동일 계약을 `contracts/orchestrator-gateway.json`으로 공개해 `ContextualWisdomLab/naruon` 판단·결정 에이전트가 1급 소비자로 재사용할 수 있게 한다. naruon 배선은 별도 저장소 PR이다. 상위 공급자 키는 오케스트레이터 KV에 남기며 OIDC 토큰 중개·App 신원·3-runner 샌드박스 경계는 유지한다.
 - 검증된 active-orphan 워크플로 하나를 운영자가 호출할 수 있는 `operations:workflow-registry-disable` 경로를 추가한다. 저장소와 워크플로 ID를 `NOEMA_MAINTAINER_TOKEN_PATH` 위임 토큰 파일 읽기 전에 검사하고, 신선한 전체 레지스트리 감사·즉시 live refresh·프로세스 로컬 plan·보호된 main/워크플로 재검증·사후 전체 감사 봉투(`schema_version` 1, `PASS`/`FAIL`, `remaining_failure_codes`, `remaining_active_orphan_ids`)를 통과한 뒤에만 영수증을 유지한다. 성공 종료와 `post_audit_status: FAIL`은 해당 ID만 `disabled_manually`가 되었고 레지스트리는 아직 더럽을 수 있음을 뜻하므로, 운영자는 영수증의 `remaining_active_orphan_ids`로 다음 단일 호출을 이어간다. 배치 비활성화·자가 수리 워크플로·거버넌스 완화는 추가하지 않으며 호출 계약은 doctoring에 기록한다.
 - 읽기 전용 `operations:runner-assignment` audit를 추가해 exact workflow run/source head에 대한 runner assignment를 완전 pagination으로 진단하고, 신선한 unassigned queue는 bounded grace 이후 실패-폐쇄한다. 이 증빙은 runner assignment와 required Check/CI, formal review, merge, release, deployment authority를 분리하며 assigned runner 이후 workflow failure를 성공으로 승격하지 않는다.

Dockerfile.patch-validator

@@ -0,0 +1,99 @@
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+FROM alpine:3.24.1@sha256:79ff19e9084a00eece421b2523fb93e22d730e2c0e525905de047e848e56d95f AS node_builder
+
+ARG NODE_VERSION=24.19.0
+ARG NODE_SOURCE_SHA256=f6d95e10a0431ee1067fc6aabe9f762908b4716dd35324e1ddb4b1466b76659f
+
+RUN apk add --no-cache \
+      binutils-gold \
+      g++ \
+      gcc \
+      libgcc \
+      libgcc-static \
+      linux-headers \
+      make \
+      python3 \
+      py3-setuptools \
+      xz
+
+ADD --checksum=sha256:${NODE_SOURCE_SHA256} https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}.tar.xz /tmp/node.tar.xz
+
+RUN mkdir -p /usr/src/node \
+    && tar -xJf /tmp/node.tar.xz --strip-components=1 -C /usr/src/node
+
+ENV PATH="/opt/node/bin:${PATH}"
+WORKDIR /usr/src/node
+
+RUN ./configure \
+      --prefix=/opt/node \
+      --fully-static \
+      --with-intl=small-icu \
+      --without-corepack \
+      --disable-single-executable-application \
+    && make -j"$(getconf _NPROCESSORS_ONLN)" V= \
+    && make install \
+    && test "$(/opt/node/bin/node --version)" = "v${NODE_VERSION}" \
+    && test "$(/opt/node/bin/npm --version)" = "11.17.0" \
+    && /opt/node/bin/node --input-type=module --eval='/\p{ID_Continue}/u.test("a")' \
+    && ! readelf -l /opt/node/bin/node | grep -q 'Requesting program interpreter' \
+    && ! readelf -d /opt/node/bin/node | grep -q '(NEEDED)' \
+    && strip /opt/node/bin/node \
+    && printf '%s\n' \
+      '{"name":"node","version":"24.19.0","cpe":"cpe:2.3:a:nodejs:node.js:24.19.0:*:*:*:*:*:*:*","license":"MIT","type":"binary","architecture":"x86_64","appCpe":"cpe:2.3:a:nodejs:node.js:24.19.0:*:*:*:*:*:*:*","system":"nodejs","vendor":"nodejs","sourceRepo":"https://github.com/nodejs/node"}' \
+      >/tmp/node-package-note.json \
+    && objcopy \
+      --add-section .note.package=/tmp/node-package-note.json \
+      --set-section-flags .note.package=noload,readonly \
+      /opt/node/bin/node \
+    && readelf -p .note.package /opt/node/bin/node \
+      | grep -Fq 'cpe:2.3:a:nodejs:node.js:24.19.0:*:*:*:*:*:*:*' \
+    && test "$(/opt/node/bin/node --version)" = "v${NODE_VERSION}" \
+    && /opt/node/bin/node --input-type=module --eval='/\p{ID_Continue}/u.test("a")' \
+    && ! readelf -l /opt/node/bin/node | grep -q 'Requesting program interpreter' \
+    && ! readelf -d /opt/node/bin/node | grep -q '(NEEDED)'
+
+FROM node_builder AS dependencies
+
+WORKDIR /build
+
+COPY package.json package-lock.json ./
+RUN npm_config_os=wasip1-threads npm_config_cpu=wasm32 \
+      npm ci --include=optional --ignore-scripts --no-audit --no-fund \
+    && npm pkg delete devDependencies.@cloudflare/workers-types devDependencies.wrangler \
+    && npm_config_os=wasip1-threads npm_config_cpu=wasm32 \
+      npm prune --include=optional --ignore-scripts --no-audit --no-fund \
+    && test -f node_modules/typescript/bin/tsc \
+    && test -f node_modules/vitest/vitest.mjs \
+    && test -f node_modules/@vitest/coverage-v8/package.json \
+    && test -f node_modules/@rolldown/binding-wasm32-wasi/package.json \
+    && test -z "$(find node_modules -type f -name '*.node' -print -quit)" \
+    && test ! -e node_modules/@cloudflare/workers-types \
+    && test ! -e node_modules/wrangler \
+    && test ! -e node_modules/workerd \
+    && test ! -e node_modules/miniflare
+
+FROM scratch AS runtime
+
+ARG SOURCE_REVISION
+LABEL org.opencontainers.image.source="https://github.com/ContextualWisdomLab/noema" \
+      org.opencontainers.image.revision="${SOURCE_REVISION}" \
+      org.opencontainers.image.title="Noema Patch Validator" \
+      org.opencontainers.image.description="Credential-free exact-head text patch validation runtime" \
+      org.opencontainers.image.documentation="https://github.com/ContextualWisdomLab/noema/blob/main/docs/patch-validator-image.md"
+
+ENV NAPI_RS_FORCE_WASI=error
+
+USER 65532:65532
+WORKDIR /workspace
+
+COPY --from=node_builder --chown=65532:65532 /opt/node/bin/node /nodejs/bin/node
+COPY --from=node_builder --chown=65532:65532 --chmod=0444 /usr/src/node/LICENSE /licenses/node/LICENSE
+COPY --from=dependencies --chown=65532:65532 /build/node_modules /opt/noema/node_modules
+COPY --chown=65532:65532 patch-validator/entrypoint.mjs /opt/noema/entrypoint.mjs
+COPY --chown=65532:65532 patch-validator/validate-patch.mjs /opt/noema/validate-patch.mjs
+COPY --chown=65532:65532 patch-validator/runtime.mjs /opt/noema/runtime.mjs
+COPY --chown=65532:65532 patch-validator/validator-tsconfig.json /opt/noema/validator-tsconfig.json
+COPY --chown=65532:65532 patch-validator/validator-vitest.config.mjs /opt/noema/validator-vitest.config.mjs
+
+ENTRYPOINT ["/nodejs/bin/node", "--input-type=module", "--eval", "import { runCli } from '/opt/noema/runtime.mjs'; import { runEntrypoint } from '/opt/noema/entrypoint.mjs'; process.exitCode = runEntrypoint({ runCliImpl: runCli, writeDiagnostic: (message) => process.stderr.write(message) });"]

Dockerfile.patch-validator.dockerignore

@@ -0,0 +1,10 @@
+*
+!package.json
+!package-lock.json
+!patch-validator/
+patch-validator/*
+!patch-validator/entrypoint.mjs
+!patch-validator/validate-patch.mjs
+!patch-validator/runtime.mjs
+!patch-validator/validator-tsconfig.json
+!patch-validator/validator-vitest.config.mjs

docs/doctoring/patch-validator-embedded-scan-assessment.md

@@ -0,0 +1,69 @@
+# Doctoring amendment: raw embedded-runtime scanner evidence
+
+## Status
+
+- **Decision date:** 2026-08-07
+- **Applies to:** PR #67 patch-validator static-runtime evidence
+- **Release claim:** none
+- **Production activation claim:** none
+- **Workflow migration state:** direct raw per-component scanning is implemented for the reviewed identity catalog; integrated acceptance remains fail-closed until the exact runtime component set is fully reviewed and exact-head verification passes
+
+This amendment supersedes the earlier locally synthesized completion model. The exact-head regressions demonstrated that a zero-match component could look complete without proving that Grype evaluated the reviewed package identity, and that independently valid per-component results could still be substituted across artifacts or vulnerability-database snapshots.
+
+## Finding
+
+An empty vulnerability match list is negative finding evidence, not proof that a particular package identity was evaluated. The earlier workflow constructed a local completion object after an aggregate SBOM scan and used generic package identities for native dependencies. That was insufficient for a fully static Node runtime because an unsupported or weak identity could produce zero matches without distinguishing “evaluated and clean” from “no applicable matcher.”
+
+The workflow now builds its inventory only from a bounded reviewed identity catalog, updates the Grype vulnerability database once, disables per-component automatic database updates, scans each reviewed PURL or CPE directly, and retains each raw scanner result. Any `process.versions` dependency without a reviewed identity aborts evidence generation instead of being omitted, converted to a generic package, or marked locally complete. The verifier independently rejects unsupported identities, synthetic completion fields, mismatched match artifacts, blocking findings, and database drift.
+
+## Control decision
+
+The embedded-runtime evidence boundary uses a **reviewed identity catalog** keyed by the exact `process.versions` key. A bundled dependency is eligible for scanning only when the catalog binds that key to the expected inventory name and to exactly one scanner-supported identity form:
+
+1. an exact npm PURL whose package name and version match the catalog and `process.versions`; or
+2. an exact CPE 2.3 application identity whose reviewed vendor, product, and version match the catalog and `process.versions`.
+
+Unknown keys, generic PURLs, wildcard or placeholder CPE vendors/products, arbitrary aliases, and identities inferred from receipt-controlled fields are explicit release blockers. Current catalog entries are deliberately bounded; adding a new native dependency requires evidence review rather than automatic identity fabrication.
+
+Every bundled dependency must carry **raw Grype** JSON for a direct scan of that exact reviewed identity. The verifier requires:
+
+- scanner descriptor `grype` at the pinned version;
+- scanner source type consistent with PURL or CPE and a source target exactly equal to the reviewed identity;
+- a valid vulnerability-database status record;
+- bounded provider metadata with capture timestamps and input digests;
+- no ignored matches;
+- every reported match artifact bound back to the same reviewed PURL or CPE and exact component version;
+- no MEDIUM, HIGH, CRITICAL, or UNKNOWN finding; and
+- the **same vulnerability database** identity across every component scan.
+
+The canonical shared database identity is derived from the database schema/build metadata plus sorted provider capture/input metadata and is retained in verification output. This makes database drift visible rather than allowing two components in one acceptance decision to be evaluated against different snapshots.
+
+The workflow updates Grype's vulnerability database once, freezes per-component auto-update for the scan set, invokes each reviewed PURL or CPE directly, and retains the raw scanner result. A local “completed” flag, aggregate-only SBOM result, scanner process exit alone, or grouped synthetic result is not evidence of component evaluation. The workflow and verifier both fail closed when the reviewed catalog is incomplete; a red exact-head action caused by an unmapped runtime dependency is therefore expected evidence of a missing review, not a reason to weaken the gate.
+
+## Why this is stricter than zero findings
+
+Grype's *Supported scan targets* documentation treats individual PURL and CPE identities as explicit scan targets. Its vulnerability-database documentation also explains that the database is locally cached and can be updated explicitly. Noema therefore binds acceptance to the literal scanner target and one shared database snapshot rather than inferring assessment from an empty match array.
+
+The National Vulnerability Database maintains the Official Common Platform Enumeration (CPE) Dictionary. Noema treats an authoritative NVD CPE mapping as reviewed identity evidence where a CPE is used; a merely syntactically valid CPE is not sufficient. For example, NVD records OpenSSL under vendor/product `openssl:openssl`, and NVD's analysis of CVE-2026-40170 maps ngtcp2 through reviewed CPE configurations including `nghttp2:ngtcp2` while identifying 1.22.1 as the fixed floor. Those mappings are controls, not heuristics generated from a package name at runtime.
+
+Node.js documents `process.versions` as version information for Node.js and its dependencies. Noema uses it as the exact-runtime dependency declaration that the reviewed component set must match, not as a cryptographic proof of binary composition. `modules` and `napi` remain explicitly reviewed runtime metadata rather than fabricated vulnerable packages.
+
+## Residual risk
+
+Raw scanner evidence does not prove that vulnerability databases are complete or that every upstream project has an authoritative ecosystem identity. Catalog omissions therefore fail closed. The scanner binary, database acquisition path, hosted runner, workflow source, CPE/PURL review process, and upstream advisory coverage remain part of the trust chain. Future registry publication must separately bind signature, SBOM, vulnerability evidence, SLSA provenance, and the published digest before release acceptance.
+
+## APA 7th references
+
+Anchore. (2026). *Supported scan targets*. Anchore Open Source. https://oss.anchore.com/docs/guides/vulnerability/scan-targets/
+
+Anchore. (2026). *Vulnerability database*. Anchore Open Source. https://oss.anchore.com/docs/guides/vulnerability/database/
+
+National Institute of Standards and Technology. (2025). *Official Common Platform Enumeration (CPE) dictionary*. National Vulnerability Database. https://nvd.nist.gov/products/cpe
+
+National Institute of Standards and Technology. (2026). *CVE-2026-40170 detail*. National Vulnerability Database. https://nvd.nist.gov/vuln/detail/CVE-2026-40170
+
+Node.js contributors. (2026). *Process: `process.versions`* (Node.js v24 documentation). OpenJS Foundation. https://nodejs.org/download/release/latest-v24.x/docs/api/process.html#processversions
+
+OWASP Foundation. (2025). *CycloneDX specification 1.7*. https://cyclonedx.org/specification/overview/
+
+Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218