ContextualWisdomLab · seonghobae · Sep 3, 2026 · Sep 1, 2026 · Sep 1, 2026 · Sep 1, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,8 @@
 # Changelog
 
 ## Unreleased
+- Workflow / Task Execution은 untrusted DAG를 execution/plan identity에 결합한 detached immutable snapshot으로 승인하고, validated array bounds 안에서만 task/dependency/state evidence를 읽는다. runnable 선택은 cross-execution·foreign·duplicate·non-canonical evidence, admitted concurrency를 초과한 running state, 성공하지 않은 prerequisite 뒤에 존재하는 causally impossible executed state를 실패-폐쇄하며, 선택 결과는 reservation이나 side-effect authority가 아닌 후보임을 명시한다. Agent Runtime lifecycle·State & Checkpoint·Workflow admission은 null·throwing accessor·revoked proxy 같은 malformed runtime input의 임의 JavaScript 예외를 각 bounded-context domain error로 정규화한다.
+- State & Checkpoint admission은 accepted/replay 결과와 내부 checkpoint를 모두 caller-owned alias에서 분리한 frozen snapshot으로 반환한다. TypeScript `readonly`만으로는 막을 수 없는 JavaScript 런타임 alias mutation이 승인된 checkpoint authority나 `accepted`/`replay` 분류를 사후 변경하지 못하도록 실패-폐쇄한다.
 - Noema의 필수 PR 워크플로 `ci`, `reviewer-ci`, `patch-validator-image`를 부동 `ubuntu-latest` 대신 명시적 `ubuntu-24.04` GitHub-hosted runner에 고정하고, 인용 여부와 무관하게 `ubuntu-latest` 회귀를 탐지하는 계약 테스트를 추가해 pre-checkout runner-assignment stall의 repository-owned selector 원인을 제거한다. 중앙 `Security Scan`의 runner/control-plane 권한은 별도 `.github` owner 경계에 유지한다.
 - 비공개 취약점 보고 감사가 16 KiB 응답 상한, bounded stream 취소, canonical repository/source identity의 독립 검증, SHA-1/SHA-256 exact revision, symlink·retained-path 보호를 실패-폐쇄로 강제한다. 이 감사 결과는 live private reporting 활성화, notification staffing, 실제 advisory 대응 또는 release/deployment 완료 증거를 대신하지 않는다.
 - External scheduler evidence audits now retain source authority through final report publication: reports are owner-only, no-follow, exclusive one-shot receipts, so a concurrent rename cannot move the accepted source inode onto the report pathname and have it replaced. Source/report path and inode alias checks, single-link retained-source validation, and Unicode control sanitization remain fail closed.
@@ -46,7 +48,7 @@
 - credential-bearing GitHub App REST 요청의 egress를 exact `https://api.github.com` origin으로 고정. 새 Worker entrypoint가 `/exchange` 전에 `GITHUB_API_BASE`의 scheme·origin·userinfo·port·path·query·fragment를 검증하고, lookalike/malformed 설정은 rate-limit·OIDC parsing·private-key 사용·GitHub API 호출 전에 `503 ERR_GITHUB_API`로 실패-폐쇄하며 허용 값도 canonical origin으로 치환한다. `/health`는 설정 복구 중에도 유지하고 원본 설정값은 응답·로그에 노출하지 않는다.
 - `src/**/*.ts` 전체에 statements·branches·functions·lines 100% coverage threshold를 강제하고, `/exchange` wrapper·OIDC replay guard·distributed limiter의 fail-closed 및 malformed-decision 경계를 회귀 테스트로 고정했다. 새 source branch가 coverage를 낮추면 CI가 즉시 실패한다.
 - `/exchange` distributed rate-limit identity가 없는 요청을 shared `unknown` bucket으로 합치지 않고 `503`으로 실패-폐쇄하도록 강화. Cloudflare의 `CF-Connecting-IP`가 정확히 하나의 유효한 IPv4/IPv6가 아니면 Durable Object lookup과 bearer parsing 전에 중단하고, 유효한 IPv6는 canonical form으로 정규화하여 동일 주소의 표기 차이가 rate-limit bucket을 분할하지 않도록 한다.
-- CI 검증 중 공개된 `undici` 취약점 묶음(GHSA-4cwx-7wf7-3272 포함)을 제거하기 위해 Wrangler→Miniflare 경유 transitive dependency를 patched `7.29.0`으로 override하고 lockfile을 재생성했다. `npm audit --audit-level=high`를 0건으로 복구하고 release gate가 취약 버전에서 실패-폐쇄하도록 유지한다.
+- CI 검증 중 공개된 `undici` 취약점 묶음(GHSA-4cwx-7wf7-3272 포함)을 제거하기 위해 Wrangler→Miniflare 경유 transitive dependency를 patched `7.29.0`으로 override하고 lockfile을 재생성했다. `npm audit --audit-level=high`가 0건으로 복구하고 release gate가 취약 버전에서 실패-폐쇄하도록 유지한다.
 - EOL 상태인 Node.js 20을 배포 계약에서 제거하고 `engines.node >=22` 및 배포 가이드의 지원 중 LTS 요구사항을 일치시켰다.
 - SQLite-backed OIDC replay guard의 alarm cleanup을 current-claim-aware 방식으로 강화. Cloudflare alarm의 at-least-once·지연·재시도 실행이 만료 후 교체된 활성 `jti` claim을 삭제하지 않도록 저장된 현재 expiry를 transactionally 재검증하고, 활성 claim이면 해당 만료 시각과 grace period로 reschedule하며 expired/empty storage만 삭제한다.
 - SQLite-backed `/exchange` rate limiter의 alarm cleanup을 current-window-aware 방식으로 강화. Cloudflare alarm의 지연·재시도 실행이 새 60초 window의 활성 bucket을 삭제해 요청 예산을 조기 재개하지 않도록 저장된 window deadline을 transactionally 재검증하고, 아직 활성인 경우 실제 reset 시각으로 reschedule하며 expired/empty storage만 삭제한다.

diff --git a/docs/CONTEXT_MAP.md b/docs/CONTEXT_MAP.md
@@ -0,0 +1,105 @@
+# Noema Context Map
+
+## Status
+
+This document separates protected behavior from the runtime-orchestration direction. Protected `main` remains the authority for what is shipped. A bounded context listed as a target does not become implemented merely because it appears here.
+
+Noema currently owns an evidence-producing credential and maintenance control plane. Expansion into agent/application runtime orchestration must reuse those existing authority boundaries rather than turning Noema into a model router, a foreign product system of record, or an arbitrary command runner.
+
+## Current protected contexts
+
+### Credential Exchange
+
+Owns GitHub Actions OIDC verification, exact reusable-workflow source identity, replay/rate controls, repository-scoped GitHub App capability minting, and the `/health`, `/ready`, `/exchange` HTTP boundary. Credential evidence is not review, merge, release, deployment, or legal authority.
+
+### Maintenance Control
+
+Owns exact-head/live-base observation, check/review/security evidence separation, short-lived maintainer capability handoff, stale-target refusal, work-conserving repository maintenance, and buyer/audit receipts. It does not own organization governance settings or foreign repository source.
+
+### Isolation Integration
+
+Owns Noema's caller-side contract for bounded quarantine and validator execution. Wardnet, EgressWeave, or another canonical isolation/security product remains authoritative for its own runtime when used. Noema consumes a versioned port/ACL and never copies the security owner's implementation.
+
+### Policy / Approval
+
+Owns the distinction between technical evidence and authority. Model judgement, scanner output, status/check results, sandbox evidence, and generated proposals cannot silently become formal approval or mutation authority.
+
+### Observability
+
+Owns bounded operational evidence for Noema behavior, exact source/run identity, readiness, KPI integrity, and buyer-verifiable receipts. Telemetry must not contain raw bearer tokens, App private keys, unnecessary reasoning payloads, or foreign product state.
+
+### Recovery
+
+Owns bounded retry/timeout/cancellation semantics, fail-closed recovery evidence, rollback preconditions, and stale-target revalidation. Silent retry of side-effecting operations is forbidden.
+
+## Runtime-orchestration target contexts
+
+The following contexts are accepted decomposition targets for new runtime behavior. They are not claims that protected `main` already implements a general-purpose agent runtime.
+
+### Agent Runtime
+
+Owns the lifecycle of one Noema agent/application execution: accepted execution identity, lifecycle state, cancellation, completion, and recovery routing. It does not discover or route models.
+
+### Workflow / Task Execution
+
+Owns explicit workflow/task dependency and execution order, bounded concurrency, idempotent step identity, and side-effect classification. Recursive/unbounded task creation and implicit duplicate side effects are forbidden.
+
+PR #528 now carries a candidate bounded task-plan admission and runnable-task selector. It accepts one canonical execution identity, a finite acyclic dependency graph, explicit `pure`/`idempotent`/`side_effecting` classification, and bounded concurrency. Declared task order is deterministic scheduling priority. Runtime state must account for every admitted task exactly once; foreign, malformed, duplicate, or incomplete state evidence fails closed. Failed or cancelled work is never selected as an implicit retry, and failed dependencies do not release descendants. Authority-bearing plan fields and nested dependencies are detached and frozen after one-time reads so caller accessors or aliases cannot change an admitted execution plan. This remains candidate behavior until protected integration.
+
+### Tool / Capability Boundary
+
+Owns versioned allowlisted tool/capability descriptors, least-authority invocation, expiry, input/output bounds, and capability provenance. Arbitrary caller/model shell or network authority is not a Noema tool contract.
+
+### State / Checkpoint
+
+Owns versioned runtime checkpoint semantics needed for restart/cancellation/idempotency. Checkpoints contain only Noema runtime state and canonical foreign references; they must not copy another product's domain truth, provider credential state, or unrestricted reasoning/tool payloads.
+
+PR #528 currently carries candidate checkpoint admission for one retained execution identity. Sequence zero initializes the checkpoint stream; an exact same-sequence/same-digest replay is idempotent; conflicting replay, stale or gapped sequence, cross-execution identity, non-canonical execution identity, and non-SHA-256 state evidence fail closed. This remains candidate behavior until protected integration and does not itself persist checkpoint payloads or grant retry/side-effect authority.
+
+## Upstream and downstream boundaries
+
+### contextual-orchestrator
+
+`ContextualWisdomLab/contextual-orchestrator` owns model discovery, routing, test-time compute, provider failover, and upstream provider credentials. Noema consumes its versioned gateway contract. Noema must not add direct provider SDKs, provider keys, fallback lists, or model-routing policy as a local substitute.
+
+### context-graph-contracts
+
+`ContextualWisdomLab/context-graph-contracts` is the provider-neutral Shared Kernel for canonical object/authority references, truth status/origin, valid/system time, provenance, Context Assertion, CloudEvents/schema, conformance, and admission contracts.
+
+Noema may integrate only against an immutable released contract package/profile. It must not import sibling repository implementation source or guess a future schema from an open Draft. Runtime/service/API/worker, integration technology, lifecycle/risk/ownership/remediation, and transformation changes can be projected only through the released versioned contract. Agent task/result/reasoning/tool payloads do not become authoritative architecture facts merely by being emitted as events.
+
+### enterprise-architecture-core
+
+`ContextualWisdomLab/enterprise-architecture-core` is the authoritative Enterprise Architecture Decision Plane. Noema publishes or exposes versioned evidence/proposals through the released Context Graph boundary; EA Core decides authoritative architecture state. Noema does not write EA application tables or reinterpret EA truth locally.
+
+### Security and isolation owners
+
+Wardnet, EgressWeave, AppGuardrail, governance-risk-compliance, and other dedicated products retain their own domain truth. Noema integrates via explicit released API/event/evidence contracts and an Anti-Corruption Layer where translation is required.
+
+## Data and integration rules
+
+- cross-service SQL is forbidden; another product's database is never a Noema integration API;
+- foreign records are held as canonical references plus bounded provenance/evidence, not copied as Noema-owned truth;
+- contract/profile version, provenance, truth status, valid time, and system time remain distinct where the released shared contract defines them;
+- absent, unreleased, stale, or non-conformant shared-contract evidence fails closed rather than triggering a source-copy workaround;
+- Noema runtime state, model/provider routing state, enterprise-architecture truth, and product-domain truth remain separately authoritative.
+
+## Dependency direction
+
+```text
+Noema Agent Runtime / Workflow / Capability / Checkpoint
+        |           |              |
+        |           |              +--> canonical isolation/security ports
+        |           +-----------------> contextual-orchestrator gateway
+        +------------------------------> released context-graph-contracts
+                                           |
+                                           v
+                              enterprise-architecture-core
+                              (authoritative EA decisions)
+```
+
+No dependency arrow grants source-write authority to the upstream or downstream repository. Each repository retains its dedicated writer and release/governance process.
+
+## Acceptance for a new runtime slice
+
+A new runtime slice is acceptable only when it has a named owning context, realistic cancellation/restart/checkpoint/idempotency/tool-policy/concurrency/isolation tests as applicable, bounded side effects, exact observability, and an explicit foreign-authority contract. A feature that requires direct provider routing, arbitrary tool authority, ambient secret propagation, unbounded recursion, silent retry, cross-service SQL, or unreleased Context Graph source is outside the accepted Noema boundary.
diff --git a/docs/PRD.md b/docs/PRD.md
@@ -86,6 +86,16 @@ The patch-validator image/runtime/supply-chain implementation is integrated on p
 
 Protected acquisition-integrity controls authenticate retained evidence and exact-release rights metadata instead of trusting persisted green booleans, mutable paths, ambiguous JSON, or bare URLs. Missing real production/customer/revenue/legal/transfer evidence remains correctly not-ready.
 
+### 4.7 Agent/application runtime orchestration
+
+On PR #528 this mode is **candidate truth only** until protected integration. Noema owns the lifecycle and safe execution mechanics of a Noema Agent/application execution; it does not acquire another CWL product's domain truth and does not become a model-provider router.
+
+The candidate Agent Runtime primitive owns explicit accepted, running, cancellation-requested, and terminal transitions. Exact duplicate delivery of the signal that already established the current state is idempotent, while contradictory or out-of-order signals fail closed. Cancellation dominates late completion. Retry/recovery uses a separate execution identity rather than receiving implicit duplicate-side-effect authority.
+
+The candidate State / Checkpoint primitive admits sequence zero as initialization, an exact same-sequence/same-digest replay as idempotent, and only the immediately next sequence for the same canonical execution identity. Conflicting replay, stale/gapped sequence, cross-execution identity, malformed identity, or non-SHA-256 state evidence is rejected. Returned checkpoint metadata is a detached frozen snapshot so caller-owned aliases cannot mutate admitted authority after validation. This primitive does not persist checkpoint payloads by itself.
+
+`contextual-orchestrator remains the sole model discovery and routing owner`; Noema does not add direct provider SDKs, provider credentials, provider fallback lists, or local routing policy. Workflow / Task Execution, Tool / Capability Boundary, Isolation Integration, Policy / Approval, Observability, and Recovery remain separate bounded contexts under ADR 0012 and the canonical Context Map. Context Graph/EA integration requires an immutable released `context-graph-contracts` contract/profile and preserves EA Core as the authoritative Decision Plane; cross-service SQL is forbidden.
+
 ## 5. Functional requirements
 
 | ID | Requirement |
@@ -108,6 +118,10 @@ Protected acquisition-integrity controls authenticate retained evidence and exac
 | FR-016 | Continue consuming the safe executable queue after one lane blocks or a scheduler/control-plane error occurs. |
 | FR-017 | Treat prompt edits, inventory, RCA, tests, docs, commits, PRs, checks, merges, and handoffs as intermediate while another required executable boundary remains. |
 | FR-018 | Delegate short-lived GitHub App installation credentials to maintenance scripts through bounded owner-only capability-file paths, not ambient parent-process secret lookup; reject unsafe file ownership, mode, type, identity, or content. Keep the exception limited to the protected bootstrap/capability contract and retain live App installation/rotation/permission evidence under #29/#227. |
+| FR-019 | Agent Runtime must use explicit execution identity and lifecycle transitions, preserve cancellation dominance and terminal integrity, make exact duplicate lifecycle delivery idempotent without granting retry/side-effect authority, and fail closed on contradictory or out-of-order signals. |
+| FR-020 | State / Checkpoint must accept only canonical same-execution monotonic checkpoint metadata, treat exact replay as idempotent, reject conflicting/stale/gapped/cross-execution evidence, require canonical SHA-256 state digests, and detach/freeze admitted metadata from caller-owned aliases. |
+| FR-021 | Model discovery, routing, test-time compute, provider failover, and provider credentials remain owned by `contextual-orchestrator`; Noema runtime code must not duplicate direct provider SDKs, credentials, fallback lists, or routing policy. |
+| FR-022 | Workflow/task, tool/capability, isolation, policy/approval, observability, recovery, Context Graph, and EA integration must cross explicit versioned ports/contracts; Context Graph integration must use immutable released versioned contracts, reject open or unreleased Draft contracts, and require conformance/admission evidence, canonical object/authority references, provenance, and valid/system time semantics. Arbitrary tool authority, ambient secret propagation, unbounded recursive work, silent side-effect retry, unreleased Context Graph source coupling, and cross-service SQL are forbidden. |
 
 ## 6. Non-functional requirements
 

diff --git a/docs/README.md b/docs/README.md
@@ -8,6 +8,7 @@
 | --- | --- |
 | 제품이 누구를 위해 무엇을 해야 하는가 | [PRD](./PRD.md) |
 | 기술적으로 어떤 invariant를 지켜야 하는가 | [TRD](./TRD.md) |
+| bounded context와 외부 authority 관계 | [Context Map](./CONTEXT_MAP.md) |
 | runtime/MSA/trust boundary | [Architecture](../ARCHITECTURE.md) |
 | 왜 이 결정을 했는가 | [ADR index](./adr/README.md) |
 | component/sequence/state/topology 그림 | [UML](./UML.md) |
@@ -57,4 +58,4 @@ These documents describe **requirements and evidence locations**. Missing real p
 
 ## Update rule
 
-A material product/security/authority change should update the smallest complete set among PRD, TRD, Architecture, ADR, UML/ERD, threat models, API, Operability, Test Strategy, Traceability, documentation-gap audit and CHANGELOG. Do not duplicate the same mutable status in many documents when a canonical owner already exists. Remove obsolete PR numbers and transient check conclusions rather than preserving them as timeless architecture facts.
+A material product/security/authority change should update the smallest complete set among PRD, TRD, Context Map, Architecture, ADR, UML/ERD, threat models, API, Operability, Test Strategy, Traceability, documentation-gap audit and CHANGELOG. Do not duplicate the same mutable status in many documents when a canonical owner already exists. Remove obsolete PR numbers and transient check conclusions rather than preserving them as timeless architecture facts.