From 83ab0744a80ffc1da9e0ea7e50eb99cc36743a49 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 07:04:42 +0900 Subject: [PATCH 1/8] test(docs): reject self-stale commercial baseline authority --- ...umentation-current-trust-authority.test.ts | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index cc504d16c..c4643aa10 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -2,16 +2,24 @@ import { readFileSync } from "node:fs"; import { describe, expect, it } from "vitest"; describe("current protected trust authority documentation", () => { - it("separates current protected source, moving central head, and immutable pin", () => { + it("separates live current authority from dated source observations and immutable pins", () => { const baseline = readFileSync("docs/product-technical-gap-baseline.md", "utf8"); - expect(baseline).toContain("protected `main@e3aa77c3f678336c548440f355f988345b0ba976`"); + expect(baseline).toContain( + "Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다", + ); + expect(baseline).toContain( + "Dated protected observation for this repair는 `main@b946d04236613544ceedb2160ed68b4e6d855dd8`", + ); + expect(baseline).toContain("merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`"); expect(baseline).toContain("central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`"); expect(baseline).toContain("`ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`"); - expect(baseline).toContain("Current source SHA는 moving observation이며 future merge 뒤 evergreen identity로 취급하지 않는다"); expect(baseline).toContain("Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며"); - expect(baseline).toContain("merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`"); - expect(baseline).not.toContain("protected `main@36e5cf957ee20a8bb3e19ff50fea6c97771d2ba1`다"); - expect(baseline).not.toContain("central `.github/main@78a4937c684a54ca8e415822c913742f41c6efc4`"); + expect(baseline).not.toMatch( + /Current protected source는 GitHub-verified protected `main@[0-9a-f]{40}`/, + ); + expect(baseline).not.toContain( + "#559가 `docs/product-technical-gap-baseline.md`와 executable documentation-authority tests의 sole writer다", + ); }); }); From e42570b16755e7a430725d841cf55262fabfdba9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 07:06:17 +0900 Subject: [PATCH 2/8] docs(commercial): make protected authority live-read and code-current --- docs/product-technical-gap-baseline.md | 30 ++++++++++++++++---------- 1 file changed, 19 insertions(+), 11 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b5b70b621..b1b96a882 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,13 +4,13 @@ 이 문서는 protected source, active candidate, transient workflow evidence와 foreign-owner authority를 분리한다. Open PR exact head, protected base, required workflow, review thread, release와 central dependency는 mutation·merge·release 직전에 다시 읽는다. predecessor GREEN, queued/pending/in-progress/skipped/cancelled run, 오래된 PR base snapshot과 scanner/model judgement는 다음 revision의 merge authority로 전용하지 않는다. queued는 GREEN이 아니다. -Current protected source는 GitHub-verified protected `main@e3aa77c3f678336c548440f355f988345b0ba976`다. Current source SHA는 moving observation이며 future merge 뒤 evergreen identity로 취급하지 않는다. 이 protected revision에는 merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`의 producer-authenticated exact-claim evidence admission과 non-vacuous reviewer publication contract, 그리고 merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`의 fail-closed external-extension Tool / Capability admission contract가 포함돼 있다. +Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@b946d04236613544ceedb2160ed68b4e6d855dd8`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive까지 포함한다. Moving central control-plane snapshot은 central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. -Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`가 포함돼 있다. 이 SHA들은 역사 증거이지 open-candidate authority가 아니다. +Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582가 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. -#559가 `docs/product-technical-gap-baseline.md`와 executable documentation-authority tests의 sole writer다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다. +이 baseline과 executable documentation-authority test는 active documentation-authority lane 하나만 write한다. mutation 직전 open PR/Issue/branch를 fresh-read해 writer를 결정하며 merged/closed historical PR 번호를 active sole writer로 고정하지 않는다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다. ## Canonical product boundary @@ -18,7 +18,7 @@ Noema Core Domain은 Agent Runtime과 Workflow / Task Execution이다. Tool / Ca `contextual-orchestrator`는 provider/model discovery, routing, retry/failover, test-time compute와 provider credential을 소유한다. Noema는 released gateway contract와 canonical `orchestrator/free` alias를 소비하며 direct provider SDK, provider key, provider/model/group fallback policy를 소유하지 않는다. `.github`는 organization reusable workflow/control-plane source다. Keyverse는 identity backend다. `quarantine-sandbox-runtime`, Wardnet, EgressWeave, AppGuardrail은 각자의 isolation/security/outbound/scanning truth를 소유한다. Noema는 그 owner evidence를 reference/pin으로 소비할 뿐 foreign implementation이나 domain table을 복제하지 않는다. Cross-service SQL과 mutable sibling PR dependency는 금지한다. -Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 durable lifecycle persistence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. +Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ## Integrated exact-claim evidence — issue #555 / merged PR #556 @@ -28,7 +28,7 @@ Protected source는 raw source receipt를 context authority로만 취급하고, ## Integrated external-extension admission — issue #545 / merged PR #560 -PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`는 unchanged exact-head application CI `34289599257`, reviewer-ci `34289599291`, required Security Scan `34289599289`, patch-validator-image `34289599248` terminal SUCCESS와 fresh clean review authority를 충족한 뒤 normal merge됐다. Resulting protected merge는 GitHub-verified `e3aa77c3f678336c548440f355f988345b0ba976`다. #559는 그 protected merge를 ordinary/non-force merge-parent로 받아 documentation authority를 수렴하며 predecessor GREEN을 재사용하지 않는다. +PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`는 unchanged exact-head application CI `34289599257`, reviewer-ci `34289599291`, required Security Scan `34289599289`, patch-validator-image `34289599248` terminal SUCCESS와 fresh clean review authority를 충족한 뒤 normal merge됐다. Resulting protected merge는 GitHub-verified `e3aa77c3f678336c548440f355f988345b0ba976`다. Historical #559 documentation work later converged from that protected source through ordinary/non-force history without transferring predecessor GREEN. Earlier Policy / Approval RED `7ca9aebee6f92053913c0bbc665c8de77650891f`의 hosted application CI `34206149899`, job `101995980303`은 valid catalog/AppGuardrail/quarantine evidence만으로 descriptor가 active/product/role grant를 self-broaden할 수 없음을 고정했다. Subsequent production source separates source/catalog/scanner authority from Noema Policy / Approval issuance, keeps the source-issued grant at a pilot ceiling, seals admission/activation/receipt provenance, revalidates the full six-field catalog identity and live scanner receipts, and rejects impossible pre-activation invocation chronology. @@ -44,9 +44,9 @@ Invocation-authority substitution RED `abcd1fea4b28b826826fed6b23296b59ceda98ca` Exact-admission provenance RED `0a32ee0a88378931a07b7e3b61cc31e3b494a7ab`는 source admission A에서 발행한 authentic activation이 동일 trusted authority가 source B로 이동한 뒤에도 artifact/product/role/policy/time이 맞으면 B를 authorize할 수 있던 결함을 재현했다. Hosted application CI `34235691056`, job `102092675348`은 exact checkout/live-base/lockfile/install/typecheck 뒤 release tests에서 실패했다. Test-only `49115306b4abf7656f7fd136de8a3ff0c5a1968b`은 retained activation replay와 public invocation-receipt replay까지 확장했다. Canonical production `225a04ec2c833e9068e79ad7b70f3f5d8f6d934a`는 core의 activation/receipt provenance를 process-global set에서 exact `AdmittedExternalExtension`-bound map으로 옮겼고, `2e843825cc31a316a5834db3d355e8e4a18ca028`은 public wrapper에 잠시 중복됐던 binding kernel을 제거해 exact-admission activation/receipt authority를 core 한 곳에 남겼다. 같은 conformance invariant는 `context-graph-contracts#27`에 foreign-owner requirement로 넘겼고 mutable issue/branch를 Noema runtime dependency로 소비하지 않는다. -Plaintext replay-retention RED `3f41d94af1454926b65b1801004fe245098742b0`는 public replay WeakMap이 reversible `JSON.stringify(normalizedRequest)`를 receipt lifetime 동안 보유해 instruction, observed content, rejected secret/product/hidden-reasoning inputs의 수명을 불필요하게 늘리던 결함을 고정했다. Hosted application CI `34237704683`, job `102099615873`은 exact checkout/live-base/lockfile/install/release typecheck 뒤 release tests에서 실패했다. Production `79182c7be196c42fb94450cae9a7857ae67b5434`는 retained replay identity를 versioned/domain-separated SHA-256 digest로 바꾸고 every semantic field, key-order independence, fixed-width/no-plaintext regression을 추가했다. ADR `ac6b6c088f034a8778bdc8a859f7157223883b8d`는 process-local WeakMap lifetime, restart fail-closed, explicit digest-version migration과 FIPS 180-4 authority를 기록하며 `Proposed`를 유지한다. +Plaintext replay-retention RED `3f41d94af1454926b65b1801004fe245098742b0`는 public replay WeakMap이 reversible `JSON.stringify(normalizedRequest)`를 receipt lifetime 동안 보유해 instruction, observed content, rejected secret/product/hidden-reasoning inputs의 수명을 불필요하게 늘리던 결함을 고정했다. Hosted application CI `34237704683`, job `102099615873`은 exact checkout/live-base guard, lockfile control, install/release typecheck 뒤 release tests에서 실패했다. Production `79182c7be196c42fb94450cae9a7857ae67b5434`는 retained replay identity를 versioned/domain-separated SHA-256 digest로 바꾸고 every semantic field, key-order independence, fixed-width/no-plaintext regression을 추가했다. ADR `ac6b6c088f034a8778bdc8a859f7157223883b8d`는 process-local WeakMap lifetime, restart fail-closed, explicit digest-version migration과 FIPS 180-4 authority를 기록하며 `Proposed`를 유지한다. -그 뒤 live security finding `5586918828`은 repository-owned TypeScript SHA-256 padding/schedule/rounds가 Tool / Capability bounded context에 불필요한 security-critical primitive ownership을 추가한다는 결함을 분리했다. Test-only `b50b43065098609118991e0b0b0b4936725c2899`은 platform `crypto.subtle.digest` 또는 independently maintained/audited exact-pinned provider를 요구하고 local `SHA256_INITIAL`, `SHA256_ROUND`, `sha256Hex` ownership을 금지했다. Hosted application CI `34240985563`, job `102111324942`은 exact checkout, live-base guard, lockfile control, install과 release typecheck를 통과한 뒤 release tests에서 terminal FAILURE가 되어 reality RED를 확정했다. 같은 generation의 reviewer-ci `34240985515`와 required Security Scan `34240985513`은 SUCCESS였고 image `34240985555`는 successor generation 때문에 CANCELLED되어 GREEN으로 전용하지 않는다. +그 뒤 live security finding `5586918828`은 repository-owned TypeScript SHA-256 padding/schedule/rounds가 Tool / Capability bounded context에 불필요한 security-critical primitive ownership을 추가한다는 결함을 분리했다. Test-only `b50b43065098609118991e0b0b0b4936725c2899`은 platform `crypto.subtle.digest` 또는 independently maintained/audited exact-pinned provider를 요구하고 local `SHA256_INITIAL`, `SHA256_ROUND`, `sha256Hex` ownership을 금지했다. Hosted application CI `34240985563`, job `102111324942`은 exact checkout, live-base guard, lockfile control, install과 release tests에서 terminal FAILURE가 되어 reality RED를 확정했다. 같은 generation의 reviewer-ci `34240985515`와 required Security Scan `34240985513`은 SUCCESS였고 image `34240985555`는 successor generation 때문에 CANCELLED되어 GREEN으로 전용하지 않는다. Production `80292ed53943c61aa9d282ed18024b0f98f4cb1f`는 home-grown hash primitive를 제거하고 replay digest를 Worker Web Crypto `crypto.subtle.digest("SHA-256", ...)`에 위임했다. `396514c8f5183324e6c8d0a16d7a5d339b2cbb72`는 digest가 성공하기 전 accepted receipt를 public authority로 publish하지 않도록 success/replay path를 비동기로 만들고 digest-provider failure를 fail closed한다. `d1af4d703bd4c67b8be26d0c105d2a4ed0d4575a`는 standard SHA-256 short/padding-boundary/multi-block/long-message vectors를, `210bc59b17933b908aa20b1de1a160b07672b687`, `90bf018cbb2ea803adb02cd8e98010288f2c8201`, `a220003532901350b1ac9fc81079c7145dbf2b6f`, `26634f181f9c29e875bdd57ab5bc046b109fd91b`는 affected replay/invocation/policy tests가 async publication contract를 실제로 await하도록 수렴시켰다. ADR `62d4ea3f6a7227e66b072e914a0711587ad22279`는 SHA-256 primitive ownership을 Worker runtime에 두고 Noema가 domain/version canonicalization, replay-state lifecycle과 fail-closed interpretation만 소유하도록 기록하며 ADR 0015는 계속 `Proposed`다. @@ -54,11 +54,19 @@ Final #560 source generation `5aab7c098f3478069127f34e398326415ec599a4`는 all-f AppGuardrail/quarantine receipts는 scanner/provenance evidence이지 Noema approval이 아니다. EgressWeave/quarantine references는 outbound/isolation operation의 대체물이 아니다. Anthropic marketplace review는 discovery evidence이지 CWL product authority가 아니다. `context-graph-contracts#27`이 immutable shared external-capability contract를 release하기 전까지 이 local port는 fail-closed ACL/test double이며 live plugin installation 또는 buyer completion을 주장하지 않는다. `context-graph-contracts#27`과 `appguardrail#1099`의 owner evidence를 Noema가 합성하지 않는다. +## Protected external-extension lifecycle persistence and operability — issue #561 / merged PRs #574–#582 + +Protected source now carries the append-only external-extension lifecycle ledger, CAS/idempotent replay, restart/current projection and complete audit path; executable operability and deployment/provenance evidence contracts; descriptor-safe retained-byte digest authority; the SQLite-backed Worker Durable Object binding `NOEMA_EXTERNAL_EXTENSION_LIFECYCLE` → `NoemaExternalExtensionLifecycle`; code-current lifecycle recovery/context-map documentation; and merged #582's private `read_operability` command. `read_operability` derives the same exact stream-scoped object identity as lifecycle reads and returns only `{ database_size_bytes }` from `ctx.storage.sql.databaseSize`; object substitution and non-canonical counters fail closed. Lifecycle event payloads, secrets, provider routing and foreign-owner truth are not exported through that path. + +This source chain does not complete #561. A genuinely new `active` transition remains fail-closed until a reviewed production adapter can re-read current Noema Policy / Approval plus immutable owner-issued AppGuardrail/quarantine/isolation/Egress evidence without copying those owners' truth into Noema. Dated dependency inventory on 2026-09-10 KST found no GitHub Releases in `appguardrail`, `quarantine-sandbox-runtime`, `EgressWeave`, or `context-graph-contracts`; mutable sibling PR/branch/package heads therefore remain ineligible production authority. + +Operational acceptance still requires the actual deployed SQLite Durable Object: realistic current-read and contended-append denominators with evaluator-computed p95 ≤20 ms where synchronous, exactly-one-winner CAS contention, >128-event audit/restart continuity, malformed/truncated state rejection, exact-object storage growth, PITR or equivalent recovery rehearsal, and deployment/release provenance authenticating the producer. Local/workerd timing, namespace storage charts, synthetic evidence and self-asserted JSON do not satisfy that boundary. + ## Evidence and merge rules Review resolution, CI, reviewer-ci, required Security, image/SBOM/provenance, branch ancestry, release는 separate evidence classes다. Every source mutation/restack invalidates predecessor workflow evidence. `queued`, `pending`, `in_progress`, `skipped`, `cancelled`, stale 또는 absent-required evidence는 passing이 아니다. -#559 predecessor exact `f4807d71ae815a5d79a08ef35628d72bb4ad34b9`의 application CI `34241457271`, job `102112384672`은 exact checkout, live-base guard, lockfile control, install과 release typecheck를 통과한 뒤 release tests에서 terminal FAILURE였다. 원인은 executable documentation-authority test가 이미 바뀐 baseline의 runtime-current RED 문구와 Web Crypto repair lineage를 따라오지 못한 stale expectation이었다. #559는 feature source를 복사하지 않고 이 baseline과 해당 documentation contract만 ordinary/non-force로 함께 수리한다. #560 integration 뒤에는 protected `main@e3aa77c3f678336c548440f355f988345b0ba976`를 ordinary merge-parent로 받아 reconverge했고, 그 뒤 source mutation은 새 exact-head generation만 merge authority가 된다. +#559 predecessor exact `f4807d71ae815a5d79a08ef35628d72bb4ad34b9`의 application CI `34241457271`, job `102112384672`은 exact checkout, live-base guard, lockfile control, install과 release typecheck를 통과한 뒤 release tests에서 terminal FAILURE였다. 원인은 executable documentation-authority test가 이미 바뀐 baseline의 runtime-current RED 문구와 Web Crypto repair lineage를 따라오지 못한 stale expectation이었다. #559는 feature source를 복사하지 않고 이 baseline과 해당 documentation contract만 ordinary/non-force로 함께 수리했다. #560 integration 뒤에는 protected `main@e3aa77c3f678336c548440f355f988345b0ba976`를 ordinary merge-parent로 받아 reconverge했고, 그 뒤 source mutation은 새 exact-head generation만 merge authority가 된다. 이 문단은 historical repair evidence이며 current writer/current protected-head authority가 아니다. Normal merge requires unchanged exact head, independently refreshed live base/head, no valid unresolved review finding, applicable required terminal-success gates and no foreign-owner/protected-contract regression. Concurrent commits나 pushes 자체를 race로 단정하지 않는다. Wrong base/conflict, stale ADR, mutable dependency, missing fixture/contract, single-writer 위반은 force push나 destructive rebase가 아니라 ordinary/non-force semantic convergence로 수리한다. @@ -69,10 +77,10 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge | Priority | Gap | Buyer/operator impact | Current owner | Status | Authoritative completion evidence | Next executable action | | --- | --- | --- | --- | --- | --- | --- | | P0 | Exact-claim evidence supply chain | Tool/research claim이 producer evidence 없이 reviewer authority가 될 위험 | protected #556 + release/consumer lanes | Source integrated; producer/release/consumer open | protected source + execution/research producer + immutable Noema release + released central consumer corpus RED→GREEN | release/producer evidence를 별도 lane에서 완성 | -| P0 | External extension lifecycle evidence | third-party plugin metadata, self-asserted grant, stale/cross-admission activation, backdated event time, divergent replay 또는 restart 뒤 process-local authority가 runtime truth로 오인될 위험 | merged #560 + issue #561 | Admission source integrated; ADR 0015 Proposed; durable lifecycle/restart evidence open | immutable source + independent scan + Noema-issued Policy / Approval + admission-bound authority + append-only versioned lifecycle stream + CAS/idempotency/restart/rollback proof + immutable shared contract/live pilot | #561에서 Noema State / Checkpoint 경계의 append-only lifecycle evidence를 구현하고 foreign owner truth는 immutable ref/digest로만 보존 | +| P0 | External extension lifecycle evidence | third-party extension의 stale/revoked authority, process-local lifecycle, forged operability 또는 unbound storage/recovery evidence가 runtime truth로 오인될 위험 | protected #574/#577/#578/#579/#580/#581/#582 + issue #561 | Lifecycle/SQLite DO source integrated; production activation adapter + deployed operability/recovery/release evidence open | immutable source + Noema Policy/Approval + immutable foreign-owner refs + append-only lifecycle/CAS/restart + exact deployed p95/contention/storage/recovery + deployment/release provenance | fail-closed `active`를 유지하고 immutable owner-issued refs가 준비된 뒤 production adapter를 연결한 후 actual deployed #561 acceptance를 실행 | | P0 | Protected-main governance closure | required Security workflow만으로 PR/review/history/deletion/bypass 통제를 증명했다고 오인할 위험 | issue #27 | Open; external control evidence absent | fresh live ruleset + required PR/review/conversation/history/deletion controls + independent bypass/break-glass evidence + protected-source governance receipt | source가 만들 수 없는 organization/admin control은 issue #27에서 독립 검증 | | P0 | Strict orchestrator/free consumer release | source 통합만으로 immutable consumer activation을 증명할 수 없음 | merged #535 + release lane | Source integrated; release/consumer open | version/tag/package/SBOM/provenance/reproducibility/rollback + released consumer | release-ready protected head에서만 publication | -| P0 | Patch-validator operational publication | source/image CI success만으로 reusable immutable runtime을 증명할 수 없음 | issue #66 | Open; publication evidence absent | protected execution + immutable image/signature/SBOM/provenance/reproducibility/rollback | explicit BuildKit cache-reuse evidence와 protected execution receipt를 확보하고 elapsed time만으로 cache hit/miss를 추정하지 않음 | +| P0 | Patch-validator operational publication | source/image CI success만으로 reusable immutable runtime을 증명할 수 없음 | issue #66 | Open; publication evidence absent | protected execution + immutable image/signature/SBOM/provenance/reproducibility/rollback | protected-main operational image receipt 뒤 immutable publication/signing/attestation/activation을 별도 증거로 완성 | | P0 | Authentic production KPI evidence | fixture·synthetic 또는 source-level KPI 검증이 실제 운영 성능을 대체할 위험 | issue #3 | Open; production window absent | authenticated production-window records + strict provenance + buyer-relevant KPI gate | 실제 production evidence 없이는 readiness를 승격하지 않음 | | P0 | Acquisition coordination | source/docs 완료를 buyer·legal·transfer readiness로 잘못 승격할 위험 | issue #5 | Open; evidence families incomplete | exact protected revision + applicable release/deployment/operational/buyer/legal evidence family | 남은 evidence family를 owner별로 수렴하고 source claim과 분리 | | P0 | External Maintainer/Reviewer App identity | source capability-file 계약이 실제 App 설치·키 custody·rotation·권한·reviewer identity를 대체할 위험 | issues #29 / #227 | Open; live identity evidence absent | live installation + key custody/rotation + repository permission + eligible reviewer/publication identity evidence | 외부 App authority는 해당 issue owner에서 독립 검증 | @@ -80,4 +88,4 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge ## Release boundary -GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. +Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. From bd10efebc60c084cf812516d1a58664bf17c23c6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 07:08:40 +0900 Subject: [PATCH 3/8] docs(commercial): preserve historical CI evidence wording --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b1b96a882..d6f02e13d 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -44,9 +44,9 @@ Invocation-authority substitution RED `abcd1fea4b28b826826fed6b23296b59ceda98ca` Exact-admission provenance RED `0a32ee0a88378931a07b7e3b61cc31e3b494a7ab`는 source admission A에서 발행한 authentic activation이 동일 trusted authority가 source B로 이동한 뒤에도 artifact/product/role/policy/time이 맞으면 B를 authorize할 수 있던 결함을 재현했다. Hosted application CI `34235691056`, job `102092675348`은 exact checkout/live-base/lockfile/install/typecheck 뒤 release tests에서 실패했다. Test-only `49115306b4abf7656f7fd136de8a3ff0c5a1968b`은 retained activation replay와 public invocation-receipt replay까지 확장했다. Canonical production `225a04ec2c833e9068e79ad7b70f3f5d8f6d934a`는 core의 activation/receipt provenance를 process-global set에서 exact `AdmittedExternalExtension`-bound map으로 옮겼고, `2e843825cc31a316a5834db3d355e8e4a18ca028`은 public wrapper에 잠시 중복됐던 binding kernel을 제거해 exact-admission activation/receipt authority를 core 한 곳에 남겼다. 같은 conformance invariant는 `context-graph-contracts#27`에 foreign-owner requirement로 넘겼고 mutable issue/branch를 Noema runtime dependency로 소비하지 않는다. -Plaintext replay-retention RED `3f41d94af1454926b65b1801004fe245098742b0`는 public replay WeakMap이 reversible `JSON.stringify(normalizedRequest)`를 receipt lifetime 동안 보유해 instruction, observed content, rejected secret/product/hidden-reasoning inputs의 수명을 불필요하게 늘리던 결함을 고정했다. Hosted application CI `34237704683`, job `102099615873`은 exact checkout/live-base guard, lockfile control, install/release typecheck 뒤 release tests에서 실패했다. Production `79182c7be196c42fb94450cae9a7857ae67b5434`는 retained replay identity를 versioned/domain-separated SHA-256 digest로 바꾸고 every semantic field, key-order independence, fixed-width/no-plaintext regression을 추가했다. ADR `ac6b6c088f034a8778bdc8a859f7157223883b8d`는 process-local WeakMap lifetime, restart fail-closed, explicit digest-version migration과 FIPS 180-4 authority를 기록하며 `Proposed`를 유지한다. +Plaintext replay-retention RED `3f41d94af1454926b65b1801004fe245098742b0`는 public replay WeakMap이 reversible `JSON.stringify(normalizedRequest)`를 receipt lifetime 동안 보유해 instruction, observed content, rejected secret/product/hidden-reasoning inputs의 수명을 불필요하게 늘리던 결함을 고정했다. Hosted application CI `34237704683`, job `102099615873`은 exact checkout/live-base/lockfile/install/release typecheck 뒤 release tests에서 실패했다. Production `79182c7be196c42fb94450cae9a7857ae67b5434`는 retained replay identity를 versioned/domain-separated SHA-256 digest로 바꾸고 every semantic field, key-order independence, fixed-width/no-plaintext regression을 추가했다. ADR `ac6b6c088f034a8778bdc8a859f7157223883b8d`는 process-local WeakMap lifetime, restart fail-closed, explicit digest-version migration과 FIPS 180-4 authority를 기록하며 `Proposed`를 유지한다. -그 뒤 live security finding `5586918828`은 repository-owned TypeScript SHA-256 padding/schedule/rounds가 Tool / Capability bounded context에 불필요한 security-critical primitive ownership을 추가한다는 결함을 분리했다. Test-only `b50b43065098609118991e0b0b0b4936725c2899`은 platform `crypto.subtle.digest` 또는 independently maintained/audited exact-pinned provider를 요구하고 local `SHA256_INITIAL`, `SHA256_ROUND`, `sha256Hex` ownership을 금지했다. Hosted application CI `34240985563`, job `102111324942`은 exact checkout, live-base guard, lockfile control, install과 release tests에서 terminal FAILURE가 되어 reality RED를 확정했다. 같은 generation의 reviewer-ci `34240985515`와 required Security Scan `34240985513`은 SUCCESS였고 image `34240985555`는 successor generation 때문에 CANCELLED되어 GREEN으로 전용하지 않는다. +그 뒤 live security finding `5586918828`은 repository-owned TypeScript SHA-256 padding/schedule/rounds가 Tool / Capability bounded context에 불필요한 security-critical primitive ownership을 추가한다는 결함을 분리했다. Test-only `b50b43065098609118991e0b0b0b4936725c2899`은 platform `crypto.subtle.digest` 또는 independently maintained/audited exact-pinned provider를 요구하고 local `SHA256_INITIAL`, `SHA256_ROUND`, `sha256Hex` ownership을 금지했다. Hosted application CI `34240985563`, job `102111324942`은 exact checkout, live-base guard, lockfile control, install과 release typecheck를 통과한 뒤 release tests에서 terminal FAILURE가 되어 reality RED를 확정했다. 같은 generation의 reviewer-ci `34240985515`와 required Security Scan `34240985513`은 SUCCESS였고 image `34240985555`는 successor generation 때문에 CANCELLED되어 GREEN으로 전용하지 않는다. Production `80292ed53943c61aa9d282ed18024b0f98f4cb1f`는 home-grown hash primitive를 제거하고 replay digest를 Worker Web Crypto `crypto.subtle.digest("SHA-256", ...)`에 위임했다. `396514c8f5183324e6c8d0a16d7a5d339b2cbb72`는 digest가 성공하기 전 accepted receipt를 public authority로 publish하지 않도록 success/replay path를 비동기로 만들고 digest-provider failure를 fail closed한다. `d1af4d703bd4c67b8be26d0c105d2a4ed0d4575a`는 standard SHA-256 short/padding-boundary/multi-block/long-message vectors를, `210bc59b17933b908aa20b1de1a160b07672b687`, `90bf018cbb2ea803adb02cd8e98010288f2c8201`, `a220003532901350b1ac9fc81079c7145dbf2b6f`, `26634f181f9c29e875bdd57ab5bc046b109fd91b`는 affected replay/invocation/policy tests가 async publication contract를 실제로 await하도록 수렴시켰다. ADR `62d4ea3f6a7227e66b072e914a0711587ad22279`는 SHA-256 primitive ownership을 Worker runtime에 두고 Noema가 domain/version canonicalization, replay-state lifecycle과 fail-closed interpretation만 소유하도록 기록하며 ADR 0015는 계속 `Proposed`다. From 8402f9a05869da96df46ac908b95e45cf03dfef0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 08:01:53 +0900 Subject: [PATCH 4/8] test(commercial): align lifecycle authority contract --- ...roduct-technical-gap-current-candidate-contract.test.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/test/product-technical-gap-current-candidate-contract.test.ts b/test/product-technical-gap-current-candidate-contract.test.ts index 824a15f2c..5502f3ee6 100644 --- a/test/product-technical-gap-current-candidate-contract.test.ts +++ b/test/product-technical-gap-current-candidate-contract.test.ts @@ -19,8 +19,11 @@ describe("product-technical gap current authority", () => { expect(baseline).toContain("Plaintext replay-retention RED"); expect(baseline).toContain("Worker Web Crypto"); expect(baseline).toContain("ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`"); - expect(baseline).toContain("merged #560 + issue #561"); - expect(baseline).toContain("append-only versioned lifecycle stream"); + expect(baseline).toContain( + "Protected external-extension lifecycle persistence and operability — issue #561 / merged PRs #574–#582", + ); + expect(baseline).toContain("append-only external-extension lifecycle ledger"); + expect(baseline).toContain("production activation adapter + deployed operability/recovery/release evidence open"); expect(baseline).toContain("context-graph-contracts"); expect(baseline).toContain("live plugin installation 또는 buyer completion을 주장하지 않는다"); expect(baseline).toContain("immutable Noema release"); From f349cebba419d8a616abe9fe890946eb04b0319a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 08:10:31 +0900 Subject: [PATCH 5/8] docs(commercial): fix historical paragraph markdown --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index d6f02e13d..f5d4d2bee 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -66,7 +66,7 @@ Operational acceptance still requires the actual deployed SQLite Durable Object: Review resolution, CI, reviewer-ci, required Security, image/SBOM/provenance, branch ancestry, release는 separate evidence classes다. Every source mutation/restack invalidates predecessor workflow evidence. `queued`, `pending`, `in_progress`, `skipped`, `cancelled`, stale 또는 absent-required evidence는 passing이 아니다. -#559 predecessor exact `f4807d71ae815a5d79a08ef35628d72bb4ad34b9`의 application CI `34241457271`, job `102112384672`은 exact checkout, live-base guard, lockfile control, install과 release typecheck를 통과한 뒤 release tests에서 terminal FAILURE였다. 원인은 executable documentation-authority test가 이미 바뀐 baseline의 runtime-current RED 문구와 Web Crypto repair lineage를 따라오지 못한 stale expectation이었다. #559는 feature source를 복사하지 않고 이 baseline과 해당 documentation contract만 ordinary/non-force로 함께 수리했다. #560 integration 뒤에는 protected `main@e3aa77c3f678336c548440f355f988345b0ba976`를 ordinary merge-parent로 받아 reconverge했고, 그 뒤 source mutation은 새 exact-head generation만 merge authority가 된다. 이 문단은 historical repair evidence이며 current writer/current protected-head authority가 아니다. +PR #559 predecessor exact `f4807d71ae815a5d79a08ef35628d72bb4ad34b9`의 application CI `34241457271`, job `102112384672`은 exact checkout, live-base guard, lockfile control, install과 release typecheck를 통과한 뒤 release tests에서 terminal FAILURE였다. 원인은 executable documentation-authority test가 이미 바뀐 baseline의 runtime-current RED 문구와 Web Crypto repair lineage를 따라오지 못한 stale expectation이었다. #559는 feature source를 복사하지 않고 이 baseline과 해당 documentation contract만 ordinary/non-force로 함께 수리했다. #560 integration 뒤에는 protected `main@e3aa77c3f678336c548440f355f988345b0ba976`를 ordinary merge-parent로 받아 reconverge했고, 그 뒤 source mutation은 새 exact-head generation만 merge authority가 된다. 이 문단은 historical repair evidence이며 current writer/current protected-head authority가 아니다. Normal merge requires unchanged exact head, independently refreshed live base/head, no valid unresolved review finding, applicable required terminal-success gates and no foreign-owner/protected-contract regression. Concurrent commits나 pushes 자체를 race로 단정하지 않는다. Wrong base/conflict, stale ADR, mutable dependency, missing fixture/contract, single-writer 위반은 force push나 destructive rebase가 아니라 ordinary/non-force semantic convergence로 수리한다. @@ -88,4 +88,4 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge ## Release boundary -Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. +Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. \ No newline at end of file From 85670aaf62be9726897a29a6b4e38f2787c4f31b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 08:11:44 +0900 Subject: [PATCH 6/8] style(commercial): preserve baseline newline --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index f5d4d2bee..071a84fd6 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -40,7 +40,7 @@ Replay semantic RED `cb8ad638875b761aea70aba78a480bd5031c4d7d`는 동일 invocat Unbound core-receipt RED `5a50a9bcfe12f3938b30e4a3cb15af8d30134391`는 internal core가 발행한 authentic receipt가 public wrapper의 invocation-envelope authority 없이 넘어갈 수 있음을 증명했다. Production `cbb64def35bad02024076c1db74e9da4739ae736`은 public binding이 없는 retained receipt를 fail closed한다. Activation-time revocation RED `8ff77d9b6428a2c09f2c72bf3b05fdb989e35843`와 production `8251d4bcd2c81dd13d252a576b55dc21e66db9c4`는 admission 뒤 policy drift/revocation을 새 activation 발행 전에 다시 읽도록 했다. -Invocation-authority substitution RED `abcd1fea4b28b826826fed6b23296b59ceda98ca`는 structurally compatible caller-supplied authority가 admission-bound live authority를 대체할 수 있음을 증명했다. Production `f8814b8fd7b66f40335df85c6aadab12aa760bc1`는 invocation에 admission 당시 결합한 동일 authority instance를 요구한다. `1acbf2f464cbfb0c5ad6e3991ecc9b04f17fb895`는 same-authority catalog/scan drift를 유지했고 `feed68db0ac0404607a292ed2686bf47e5e2be22`는 운영/rollback owner 경계를 갱신했다. Hosted application CI `34230994573`, job `102076920357`이 4,190 passed / 10 failed로 드러낸 stale fixture는 `532cfaadf655d3158434db8a1c3a985a33ad3a9f`, `ab2baeda9665df96753a03f1242455efe0662e41`, `273aa711d1c7611fadab9346944891548b30919a`에서 same-authority intent를 유지하면서 mutable test cache를 제거했다. +Invocation-authority substitution RED `abcd1fea4b28b826fed6b23296b59ceda98ca`는 structurally compatible caller-supplied authority가 admission-bound live authority를 대체할 수 있음을 증명했다. Production `f8814b8fd7b66f40335df85c6aadab12aa760bc1`는 invocation에 admission 당시 결합한 동일 authority instance를 요구한다. `1acbf2f464cbfb0c5ad6e3991ecc9b04f17fb895`는 same-authority catalog/scan drift를 유지했고 `feed68db0ac0404607a292ed2686bf47e5e2be22`는 운영/rollback owner 경계를 갱신했다. Hosted application CI `34230994573`, job `102076920357`이 4,190 passed / 10 failed로 드러낸 stale fixture는 `532cfaadf655d3158434db8a1c3a985a33ad3a9f`, `ab2baeda9665df96753a03f1242455efe0662e41`, `273aa711d1c7611fadab9346944891548b30919a`에서 same-authority intent를 유지하면서 mutable test cache를 제거했다. Exact-admission provenance RED `0a32ee0a88378931a07b7e3b61cc31e3b494a7ab`는 source admission A에서 발행한 authentic activation이 동일 trusted authority가 source B로 이동한 뒤에도 artifact/product/role/policy/time이 맞으면 B를 authorize할 수 있던 결함을 재현했다. Hosted application CI `34235691056`, job `102092675348`은 exact checkout/live-base/lockfile/install/typecheck 뒤 release tests에서 실패했다. Test-only `49115306b4abf7656f7fd136de8a3ff0c5a1968b`은 retained activation replay와 public invocation-receipt replay까지 확장했다. Canonical production `225a04ec2c833e9068e79ad7b70f3f5d8f6d934a`는 core의 activation/receipt provenance를 process-global set에서 exact `AdmittedExternalExtension`-bound map으로 옮겼고, `2e843825cc31a316a5834db3d355e8e4a18ca028`은 public wrapper에 잠시 중복됐던 binding kernel을 제거해 exact-admission activation/receipt authority를 core 한 곳에 남겼다. 같은 conformance invariant는 `context-graph-contracts#27`에 foreign-owner requirement로 넘겼고 mutable issue/branch를 Noema runtime dependency로 소비하지 않는다. @@ -88,4 +88,4 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge ## Release boundary -Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. \ No newline at end of file +Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. From b200420a010a50374817f7b67dc30fc9d52bde54 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 08:18:24 +0900 Subject: [PATCH 7/8] docs(commercial): restore historical exact hash --- docs/product-technical-gap-baseline.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 071a84fd6..bc510cb56 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -40,7 +40,7 @@ Replay semantic RED `cb8ad638875b761aea70aba78a480bd5031c4d7d`는 동일 invocat Unbound core-receipt RED `5a50a9bcfe12f3938b30e4a3cb15af8d30134391`는 internal core가 발행한 authentic receipt가 public wrapper의 invocation-envelope authority 없이 넘어갈 수 있음을 증명했다. Production `cbb64def35bad02024076c1db74e9da4739ae736`은 public binding이 없는 retained receipt를 fail closed한다. Activation-time revocation RED `8ff77d9b6428a2c09f2c72bf3b05fdb989e35843`와 production `8251d4bcd2c81dd13d252a576b55dc21e66db9c4`는 admission 뒤 policy drift/revocation을 새 activation 발행 전에 다시 읽도록 했다. -Invocation-authority substitution RED `abcd1fea4b28b826fed6b23296b59ceda98ca`는 structurally compatible caller-supplied authority가 admission-bound live authority를 대체할 수 있음을 증명했다. Production `f8814b8fd7b66f40335df85c6aadab12aa760bc1`는 invocation에 admission 당시 결합한 동일 authority instance를 요구한다. `1acbf2f464cbfb0c5ad6e3991ecc9b04f17fb895`는 same-authority catalog/scan drift를 유지했고 `feed68db0ac0404607a292ed2686bf47e5e2be22`는 운영/rollback owner 경계를 갱신했다. Hosted application CI `34230994573`, job `102076920357`이 4,190 passed / 10 failed로 드러낸 stale fixture는 `532cfaadf655d3158434db8a1c3a985a33ad3a9f`, `ab2baeda9665df96753a03f1242455efe0662e41`, `273aa711d1c7611fadab9346944891548b30919a`에서 same-authority intent를 유지하면서 mutable test cache를 제거했다. +Invocation-authority substitution RED `abcd1fea4b28b826826fed6b23296b59ceda98ca`는 structurally compatible caller-supplied authority가 admission-bound live authority를 대체할 수 있음을 증명했다. Production `f8814b8fd7b66f40335df85c6aadab12aa760bc1`는 invocation에 admission 당시 결합한 동일 authority instance를 요구한다. `1acbf2f464cbfb0c5ad6e3991ecc9b04f17fb895`는 same-authority catalog/scan drift를 유지했고 `feed68db0ac0404607a292ed2686bf47e5e2be22`는 운영/rollback owner 경계를 갱신했다. Hosted application CI `34230994573`, job `102076920357`이 4,190 passed / 10 failed로 드러낸 stale fixture는 `532cfaadf655d3158434db8a1c3a985a33ad3a9f`, `ab2baeda9665df96753a03f1242455efe0662e41`, `273aa711d1c7611fadab9346944891548b30919a`에서 same-authority intent를 유지하면서 mutable test cache를 제거했다. Exact-admission provenance RED `0a32ee0a88378931a07b7e3b61cc31e3b494a7ab`는 source admission A에서 발행한 authentic activation이 동일 trusted authority가 source B로 이동한 뒤에도 artifact/product/role/policy/time이 맞으면 B를 authorize할 수 있던 결함을 재현했다. Hosted application CI `34235691056`, job `102092675348`은 exact checkout/live-base/lockfile/install/typecheck 뒤 release tests에서 실패했다. Test-only `49115306b4abf7656f7fd136de8a3ff0c5a1968b`은 retained activation replay와 public invocation-receipt replay까지 확장했다. Canonical production `225a04ec2c833e9068e79ad7b70f3f5d8f6d934a`는 core의 activation/receipt provenance를 process-global set에서 exact `AdmittedExternalExtension`-bound map으로 옮겼고, `2e843825cc31a316a5834db3d355e8e4a18ca028`은 public wrapper에 잠시 중복됐던 binding kernel을 제거해 exact-admission activation/receipt authority를 core 한 곳에 남겼다. 같은 conformance invariant는 `context-graph-contracts#27`에 foreign-owner requirement로 넘겼고 mutable issue/branch를 Noema runtime dependency로 소비하지 않는다. From b47f405675fc92e68154b66df0395d6c5c927ad6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 08:33:48 +0900 Subject: [PATCH 8/8] docs(adr): index protected acquisition decision --- docs/adr/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/adr/README.md b/docs/adr/README.md index bde2b5bb0..7d7af7302 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -19,6 +19,7 @@ ADR은 **왜 이 구조를 선택했는지**를 기록합니다. 구현 상태 | [0013](./0013-durable-workflow-execution-authority.md) | Proposed | runnable candidate와 durable claim/effect start/terminal recovery/checkpoint commit을 분리하고 bounded transition provenance를 Noema state-store 경계에 둔다. | | [0014](./0014-shared-noema-core-package.md) | Proposed | role-neutral PydanticAI `Agent(...)` construction만 `packages/noema-core` Shared Kernel로 추출하고 provider routing·credential policy·verdict·tool/deps·tenant truth는 canonical owner에 남긴다. | | [0015](./0015-external-extension-admission.md) | Proposed | Claude community plugin은 exact commit/path/digest와 별도 scan 영수증으로만 승인하고, 마켓플레이스 설치·Anthropic 리뷰·제품 런타임 래퍼는 실패-폐쇄한다. | +| [0016](./0016-avoid-repository-git-conversion-execution-in-acquisition-preflight.md) | Proposed | acquisition preflight는 repository-owned Git clean/process conversion helper를 실행하지 않고 immutable exact-tree와 descriptor-bound raw bytes로 checkout identity를 검증한다. | ## ADR lifecycle