fix(governance): preserve delegated capability path authority by seonghobae · Pull Request #503 · ContextualWisdomLab/noema

seonghobae · 2026-08-25T03:10:21Z

Scope

Test-first hardening of Noema's delegated GitHub capability path, workflow-registry evidence authority, private acquisition-output authority, and reviewer sandbox/supply-chain boundary. GitHub Ready state is not merge authority while the exact-head image/SBOM/provenance gate is non-passing.

Current causal repair — transactional acquisition writer-lock authority

A reviewed BUG finding identified a real recovery defect in scripts/lib/acquisition-private-output.mjs: failed lock creation/inspection/close could leave the target reserved in-process and poison later same-process retries.

The repaired implementation makes acquisition transactional: on failure it best-effort closes any opened descriptor, proves cleanup authority by descriptor/path inode identity before unlinking, preserves uncertain lock paths fail-closed, releases the in-process reservation before rethrowing, and preserves the original acquisition error. Realistic tests cover one-shot open/fstat/close failures, replacement-lock identity, and a vanished-lock race without excluding production policy from coverage.

All visible defect findings for this repair are resolved. Current remaining visible review threads are resolved or informational; no valid unresolved defect finding is currently known.

Exact current authority

Fresh identity:

protected base: main@d53897f28abb0aca6d3dd2c0295f0c4f4e81f076 (the protected fix(egress): bound anonymous GitHub API authority #500 integration);
exact head: e49d37e515ef07ee20f9a2bb162006025f56ccc1;
PR: open / Ready / mergeable;
Application CI 33305991817: terminal-success;
reviewer-ci 33305991793: terminal-success;
required Security Scan 33305991790: terminal-success;
dedicated patch-validator-image 33305991803: in progress / non-passing.

No predecessor image result transfers to this head. Runtime identity, no-network/read-only/non-root smoke, CycloneDX SBOM, vulnerability-receipt, exact-source/image, and provenance evidence remain non-authoritative until the dedicated exact-head job terminates successfully.

Dependency and governance boundary

#500 is now protected-main truth; this lane has already converged onto that protected revision rather than remaining on the historical #500 predecessor base. Post-#500 successor #508 is a separate bounded egress/test-contract promotion and is not permission to infer this PR's image evidence.

The repository-effective organization ruleset 18794436 remains active on ~DEFAULT_BRANCH, requires ContextualWisdomLab/.github:.github/workflows/security-scan.yml@refs/heads/main, has bypass_actors=[], and reports current_user_can_bypass=never.

Protected central .github/main is currently 2c725dd928c884db2ea0d5d1e3442d54e6f3d7d4. Its current Security Scan blob SHA is 148e944310593958d7c6dd96590c5327a0c4b355, unchanged from the previously observed protected scanner generation, so the central-main movement did not silently replace the scanner contract. Central .github, naruon, contextual-orchestrator, and other dedicated-writer repositories remain read-only dependencies for this Noema writer.

Merge boundary

Do not merge #503 while any applicable exact-head gate is pending/queued/skipped/failed/cancelled/stale or otherwise non-passing, while a valid unresolved finding exists, or after base/head movement without fresh revalidation. Exact 100% owned-production line/branch/function/statement coverage remains mandatory. Source/check evidence does not synthesize production deployment, publication, buyer, or legal-transfer evidence.

devin-ai-integration

Note