fix(context-fabric): require source-bound release attestation

[seonghobae]

Scope

Strengthen Noema's Context Graph consumer ACL without copying context-graph-contracts source or treating mutable producer PRs as authority. Noema requires exact release-source manifest + independently retained attestation digests, protected source ref and signer workflow, canonical Context Assertion/CloudEvent profile identities, and versioned context-assertion-envelope-preserving-admission-v1 capability evidence. Cross-service SQL, mutable producer source, provider routing and foreign security authority remain out of scope.

Retained TDD lineage

RED 1e2603bb... → production 20b8bead... bound exact protected-source manifest/attestation evidence; RED 834b4ac8... → 4f04a78a... added finite canonical capability metadata; RED e0f0dc0b... → c72ce1cb... added versioned envelope-preserving admission. Hosted fitness failures were repaired without weakening immutable-release semantics. The latest predecessor showed a Markdown-sensitive raw-substring fixture; d5ecf8331d78db1e5d1b5505e818a1f8aed01076 strips backticks only for the semantic assertion while preserving the exact immutable released context-graph-contracts requirement.

Current exact authority — 2026-09-06 KST

• protected Noema base: main@e1ac9d50f6c646f04be8c137c8acdc7200182fcd;
• exact PR head: d5ecf8331d78db1e5d1b5505e818a1f8aed01076;
• lifecycle: open / Draft;
• exact-head application ci 33952078330, required Security Scan 33952078410, reviewer-ci 33952078464, and patch-validator-image 33952078542 are terminal success;
• repository-wide semantic-review prerequisite is fix(reviewer): fail closed on empty CodeGraph semantics #546 exact 95144d5bcf8f1cb4b9a7c552ede66737c23d6bca. The reviewer success above predates that repaired semantic-evidence contract reaching protected truth, so it is workflow-surface evidence rather than merge-authoritative semantic GREEN.

Keep the source unchanged and Draft. After #546 reaches protected truth, regenerate semantic reviewer evidence for this exact head and re-read current governance. Do not promote mutable producer evidence, weaken the release attestation contract, source-churn for runners, self-approve, rewrite history, or absorb Context Graph/CO/security owner authority.

Summary by CodeRabbit

• 새 기능

  • 컨텍스트 계약 릴리스 검증에 소스 매니페스트와 독립 attestation 확인을 추가했습니다.
  • 릴리스 증거에 보호된 소스 참조, 서명 워크플로 및 해시 정보가 포함됩니다.
  • 컨텍스트 어설션 보존 및 소스 검증 capability를 필수 항목으로 지원합니다.

• 문서

  • 런타임 오케스트레이션 프리미티브와 보호된 구현 경계에 관한 ADR을 업데이트했습니다.

• 테스트

  • 잘못된 capability 형식과 불일치하거나 누락된 릴리스 소스를 거부하는 검증을 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 7eebfe00-7101-45cb-8b9b-ffb9a20b63d7

📥 Commits

Reviewing files that changed from the base of the PR and between 85b1701 and 35ab2d0.

📒 Files selected for processing (7)

• docs/adr/0012-runtime-orchestration-bounded-contexts.md
• src/context-fabric/context-contract-release-admission.ts
• test/context-contract-release-admission-boundaries.test.ts
• test/context-contract-release-admission.test.ts
• test/context-contract-release-capability-proxy-errors.test.ts
• test/context-contract-release-source-attestation.test.ts
• test/runtime-bounded-context-fitness.test.ts

---

📝 Walkthrough

Walkthrough

Context 계약 릴리스 admission이 보호된 소스 매니페스트와 attestation을 검증하도록 확장되었다. envelope 보존 capability와 보호된 소스 식별자가 릴리스 증거에 추가되었다. ADR과 관련 테스트도 갱신되었다.

Changes

Context 계약 릴리스 admission

Layer / File(s)	Summary
보호된 릴리스 계약 docs/adr/0012-runtime-orchestration-bounded-contexts.md, src/context-fabric/context-contract-release-admission.ts	ADR이 보호된 런타임 경계와 Context Graph 릴리스 요구사항을 반영한다. 릴리스 증거에 소스 매니페스트 해시, attestation 해시, 보호된 source ref, signer workflow가 추가되었다.
릴리스 증거 검증 src/context-fabric/context-contract-release-admission.ts	SHA-256 형식, 보호된 소스 값, canonical capability 식별자와 source-manifest attestation 일치를 검증한다. Production admission은 불일치와 authority 조회 실패를 거부한다.
Admission 테스트 적용 test/context-contract-release-admission-boundaries.test.ts, test/context-contract-release-admission.test.ts, test/context-contract-release-capability-proxy-errors.test.ts, test/context-contract-release-source-attestation.test.ts, test/runtime-bounded-context-fitness.test.ts	새 필드의 기본값, capability 누락, 형식 오류, 소스 불일치, attestation 누락과 ADR 문서 검증을 테스트한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/context-release-source-attestation-admission

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh protected-base repair supersedes the stale authority block above. Protected main is now e1ac9d50f6c646f04be8c137c8acdc7200182fcd. Ordinary two-parent non-force merge 9a064db4b38314728fd985249e3643c1f12ca435 preserves the complete #544 Context Graph release-attestation delta and inherits only the protected stateless GitHub installation-token regression. Current exact-head workflows are ci 33871855445, reviewer-ci 33871855476, required Security Scan 33871855442, and patch-validator-image 33871855421; all are queued/non-passing. Predecessor evidence does not transfer; keep Draft.