feat(agent-runtime): gate procedural guidance by execution lifecycle

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ## Unreleased
 - Agent Runtime에 tenant/task/execution-scoped immutable procedural graph와 bounded advisory context, paired held-out candidate screening을 추가한다. 모든 candidate decision은 `activationAuthorized: false`를 유지하고 tool·retry·Policy/Approval·provider routing·credential·foreign-domain authority를 부여하지 않는다. 그래프/평가 wire contract는 아직 Noema-local이며 cross-service publication은 context-graph-contracts의 immutable release를 기다린다. issue #584, ADR 0017.
+- Agent Runtime의 procedural guidance를 locally admitted session brand와 canonical execution lifecycle에 결합한다. 구조만 흉내 낸 session은 callback/property를 읽기 전에 거부하고, guidance는 동일 execution의 `running` 상태에서만 반환하며 accepted·cancellation-requested·terminal 상태에서는 context request를 읽지 않고 억제한다. 결과는 계속 `advisory_only`이고 tool·retry·Policy/Approval·transition authority를 만들지 않는다. issue #584.
 - External-extension lifecycle의 private Durable Object command surface에 `read_operability`를 추가해 exact stream-scoped SQLite `ctx.storage.sql.databaseSize`를 `{ database_size_bytes }`로만 노출한다. canonical object-name binding이 다르면 409로 거부하고, 음수·비정수 storage counter는 내부 오류로 실패-폐쇄해 #561의 실제 per-object storage-growth evidence producer가 synthetic fixture나 namespace aggregate 대신 deployed object-local byte counter를 소비할 수 있게 한다. 이 경로는 lifecycle event payload·foreign-owner truth·secret·provider routing을 노출하지 않으며 remote p95/contention/recovery, production activation authority, deployment 또는 immutable release acceptance를 대신하지 않는다. issue #561.
 - CVE-2026-84373 remediation을 위해 Vitest 개발/테스트 툴체인을 4.1.9에서 패치된 4.1.11 라인으로 올린다(`vitest`, `@vitest/coverage-v8`, canonical `package-lock.json` 재생성, reviewed lockfile change policy, `test/vitest-security-lock.test.ts` 회귀 게이트 포함). Vitest 4.1.11이 끌어온 rolldown 1.2는 WASI 바인딩을 `optionalDependencies`에서 내려도 패키지 자체는 계속 발행하므로, `@rolldown/binding-wasm32-wasi`를 lock 버전에 맞춘 exact devDependency로 명시해 WASI-only patch-validator의 이식성을 유지한다. issue #568.
 - Tool / Capability Boundary에 Claude community plugin 외부 확장 승인 포트를 추가한다. 마켓플레이스 메타데이터, 가변 브랜치/태그, Anthropic 리뷰, 플러그인 지시문은 승인 권한이 아니다. exact commit/path/digest, AppGuardrail·격리 영수증, 독립 Noema Policy / Approval, 제품/역할 범위, 만료·롤백, 중복 활성화 재현만 통과한다. Policy / Approval은 명시적 immutable trust input이어야 하며 source-default pilot grant나 합성 owner digest를 production authority로 사용하지 않는다. activation과 invocation replay는 admission port가 실제 발행한 in-process authority만 인정하고, invocation은 activation 이후 시각이어야 하며 activation 범위, live catalog 여섯 identity field, AppGuardrail·quarantine receipt의 현재 존재와 artifact/policy/owner binding을 다시 검증한다. 제품 런타임에서는 플러그인 래퍼를 실행하지 않는다. `context-graph-contracts` 불변 계약이 나오기 전에는 로컬 포트와 테스트 더블만 쓴다. issue #545, ADR 0015.

docs/doctoring/procedural_graph_adoption.md

@@ -0,0 +1,118 @@
+# Procedural graph adoption: source evidence and integration gates
+
+Status: Proposed implementation and rollout record, not release or deployment acceptance.
+Date: 2026-09-10.
+
+This record accompanies [ADR-0017](../adr/0017-procedural-graph-guidance.md),
+[Noema #584](https://github.com/ContextualWisdomLab/noema/issues/584),
+[core #585](https://github.com/ContextualWisdomLab/noema/pull/585), and
+[lifecycle #586](https://github.com/ContextualWisdomLab/noema/pull/586).
+The organization work item is [CWL #2067](https://github.com/ContextualWisdomLab/.github/issues/2067).
+The canonical EA adoption matrix belongs to enterprise-architecture-core, not this document.
+
+## What the sources support
+
+Lu et al. (2026) represent procedural knowledge using procedure/relation/procedure
+triples. At each decision step, an active procedure is localized and a guidance
+model translates its neighboring subgraph into situational advice. The solver is
+influenced by that advice, not replaced by a hard graph controller. During offline
+self-evolution, a refiner compares failed and successful task trajectories and
+proposes graph edits. Held-out validation screens edits for non-decreasing measured
+performance; rejected edits are retained. The graph remains fixed during inference.
+These are method claims from the paper, not observations from CWL deployments.
+The Korean blog below motivated this adoption request; the primary method reference
+is the paper rather than the blog's interpretation or comparative scores.
+
+## CWL decisions, not claims made by the paper
+
+| Concern | CWL adaptation and observable acceptance |
+| --- | --- |
+| Advice versus authority | Graphs and contexts cannot invoke tools or authorize execution, credentials, approval, merge, publication or deployment. Candidate screening always returns `activationAuthorized: false`. |
+| Scope and identity | Graph tenant/task/digest are compared exactly. Execution IDs use Noema's existing `isCanonicalExecutionId`, not the narrower graph-node grammar. Graph identity and execution identity are different contracts. |
+| Local object admission | Only frozen graph sessions issued by the owning module may enter the lifecycle adapter. Copied objects, proxy wrappers and forged callbacks are rejected before session property access. This is local object integrity, not caller authentication. |
+| Unknown or oversized neighborhood | Return unavailable advice for `unknown_procedure` or `context_budget_exceeded`; do not turn abstention into success, return the entire graph, or silently drop prerequisite relationships. |
+| Execution lifecycle | Given fresh authenticated lifecycle state, only a running execution receives advice. Accepted, cancelling and terminal executions do not evaluate the neighborhood request. The pure adapter is not a durable revocation store and cannot detect replay of an old running snapshot. |
+| Candidate comparison | Require exact base/candidate lineage, matching evaluation context, complete paired cases, disjoint train/holdout IDs and finite normalized scores. Reported candidate safety violations block eligibility regardless of mean gain. |
+| Independent acceptance | Arithmetic non-regression is not statistical significance, construct validity, standard setting or approval. Independent evaluation and final confirmation remain prerequisites. |
+| Data and secrets | No new credential, `.env` read, provider client, raw trajectory store or hidden-reasoning capture is introduced. Guidance text is still untrusted data; these modules do not detect prompt injection or scrub sensitive content. |
+
+## Concrete repair evidence
+
+The initial native core run at `5813ee1cb8958aa25e622fe31adfa8dc229f2e3c`
+passed typecheck but failed the public API documentation inventory. Its 4,443
+passing tests did not make the remaining failure acceptable. Subsequent source
+changes documented exports, moved the colliding procedural ADR from 0016 to 0017,
+and recorded the behavior under Unreleased without weakening those gates.
+
+The session producer repair at `9056eb24b0841c12c807464ea8ecc5e557222c05`
+adds `assertProceduralSession`. Its valid delta is retained, not replaced with a
+second session-admission implementation. The parent repair at
+`a99b8615c0959252e6fa78029203e9983f840356` reuses canonical execution identity
+and adds strict session-admission regressions. Concurrent child integration
+`fa4b0fd7598a1308015bbd0f4a897c1c9e19bc15` preserves both parent and child
+history by an ordinary merge.
+
+Against the child's unchanged source blob
+`8f70e36e7780f26ee3a414a14a4fd955ad201fe2`, the expanded local battery
+reported 138 passing and two failing assertions: both graph-abstention results
+were advertised as available. The repair preserves the owner's session-admission
+assertion and propagates the two abstention reasons with `available: false` and
+`context: null`. Redundant checks of identities constructed by the already-admitted
+frozen closure are removed; the lifecycle/session identity comparison remains.
+
+The final local battery passed 140 assertions with no failures or skips. It used
+Node 22.16.0 and TypeScript 5.8.3, strict compiled source, and a mechanical Vitest
+import-to-`node:test` adapter. The lifecycle import was represented by its existing
+type shape for this isolated build; this battery does not execute the complete
+lifecycle runtime or original child lifecycle integration suite. Native repository
+Node/npm/Vitest tests, all coverage thresholds, security, review and deployment
+checks remain independent requirements. No CI threshold, lockfile or runtime
+version was altered to turn this diagnostic result into acceptance.
+
+## Owner-led rollout and exit criteria
+
+| Stage | Responsible owner and concrete next delivery | Exit evidence |
+| --- | --- | --- |
+| Source readiness | Noema: complete #585 and #586, preserve parent-first ancestry and existing runtime boundaries. | Native unchanged exact-head typecheck, full tests/coverage, applicable security/image checks and review; protected merge recorded separately. |
+| Interchange release | context-graph-contracts #28: graph/context/evaluation/decision schema, digest semantics and hostile conformance fixtures. | Immutable released contract and compatible independent consumer fixtures. Local `noema.procedural-graph/v1` is not already that release. |
+| Ownership inventory | enterprise-architecture-core #50: task/profile owner, consumer port, contract pin, evaluation profile and rollback owner for each applicable product. | Evidence distinguishes proposed, source, released, shadow, canary, active and rollback-tested. Deterministic kernels may be not applicable with a recorded reason. |
+| First shadow connection | contextual-orchestrator #1116 plus .github and Naruon owners: connect guide/solver roles through the existing gateway without write-side activation. | Observed matched no-graph/fixed-graph/evolved-graph runs; task success, sequencing errors, duplicate effects, cost/tokens and latency reported separately. |
+| Independent evaluation | psychometrics-commons #447: task stimuli, item/rubric definitions, paired evidence protocol, validation-search and untouched final confirmation separation. | Authenticated producer and exact graph/model/tool/dataset/rubric/context binding; justified evidence size and uncertainty; independent acceptance. |
+| Offline state integration | Noema State/Checkpoint and Policy/Approval: minimized observations, candidate storage, scoped rejection retention, approval, compare-and-swap promotion, rollback and revocation. | Crash/replay/stale-writer tests and authentic approval/evidence references; running sessions keep their pinned revision and obey current revocation. |
+| Product canary | Product owners: versioned adapter and domain-specific procedure/profile; no copied graph runtime. | Released contract conformance, observed invocation, domain regressions, independent side-effect controls and tested disable/rollback. |
+
+The first product scenarios are central review/finding verification and Naruon's
+read-only task handling. Candidate later scenarios include Bandscope analysis
+review, TEPP research workflow, Orgmetra assessment preparation, accounting close
+review, billing reconciliation, supply-chain exception handling, learning-content
+review and Inkspan document preparation. These are proposed use cases, not a
+claim that those products currently call this library. Employment decisions,
+accounting postings, charges, data deletion and deployment retain their own policy
+and human-approval boundaries. Domain facts remain with their original owners.
+
+Model work stays behind contextual-orchestrator. Model-backed Actions use only
+`orchestrator/free`; provider selection and free-pool fallback remain inside that
+owner, with Keyverse holding credential authority. This work adds neither a paid
+fallback nor an application-wide model timeout. Graph traversal limits are data
+bounds, not elapsed-inference-time limits. No new scheduler or organization fanout
+is necessary for this source slice.
+
+## Remaining gaps that block active adoption
+
+There is no production graph/trajectory store, signed receipt verifier, automatic
+refiner, independently approved promotion API or product invocation in these two
+PRs. There is also no evidence yet that graph guidance improves CWL tasks or meets
+product latency targets. The owning root product/technical baseline must retain
+these gaps and link this record without replacing historical results. Do not mark
+ADR-0017 Accepted, publish a release, or advertise organization-wide activation
+from local tests or the existence of tracking issues.
+
+## References
+
+Lu, Y., Chen, Y., Wu, S., & Arık, S. Ö. (2026). *Procedural graphs: Self-evolving
+execution structures for LLM agents* (Version 1) [Preprint]. arXiv.
+https://arxiv.org/abs/2609.09153
+
+코난쌤. (2026, September 10). *Procedural Graph: LLM 에이전트를 위한 자가진화
+절차 그래프 (arXiv 2609.09153) 논문 정리*. 코난쌤 블로그.
+https://conanssam.com/posts/2026-09-10-procedural-graphs-self-evolving-llm-agents