feat(agent-runtime): gate procedural guidance on current durable workflow evidence

[seonghobae]

Scope

Add a Noema Agent Runtime current-state ACL for workflow-backed procedural guidance. It reuses the existing execution-scoped NOEMA_WORKFLOW_STATE durable authority before advice is exposed. It does not create a second lifecycle database, grant Policy/Approval, change Workflow / Task domain truth, or turn procedural graph state into activation authority.

RED / causal lineage

• Test-first 8565dd32c2111b1f06a91f36bd2d7928834b97e2 requires a fresh durable read on each guidance decision and proves that a previously running advisory decision is suppressed after newer cancellation evidence. The PR did not yet exist at that commit, so this is source/test-first RED lineage rather than hosted terminal RED.
• c102725994303d29925b4c3e32bd2edfe3c11261 adds the minimum read-only ACL over the existing workflow-state owner.
• 6417600fd38a5a02aee9b8a2b74b4afcb4d8adbf removes redundant internal projection state/unreachable completeness checking rather than excluding it from coverage.
• ef73b23fa17cca7734cc28534b49ef0e153c6490 expands fail-closed coverage across owner conflict/unavailability, malformed envelopes, execution/plan/task/cancellation corruption, terminal taxonomy, and recovered all-pending state.
• 014119cd4a2d5f9cda039c7291a3fbdea9003a09 updates Proposed ADR-0017 with the DDD ownership decision and explicit deployed-evidence limitations.
• db172c3e483cb5c7036dd0c3aa7b37c8edeca962 updates the procedural adoption record while preserving protected feat(agent-runtime): add advisory procedural graphs and guarded candidate screening #585/feat(agent-runtime): gate procedural guidance by execution lifecycle #586 history and keeping feat(agent-runtime): gate procedural guidance on current durable workflow evidence #589 candidate-only until merge.
• Test-first ea5a4597d24a71ed49f016164220d47c123fdea8 adds a regression requiring cross-execution plan/session mismatch to fail before any NOEMA_WORKFLOW_STATE Durable Object lookup. Its hosted generation was superseded by the causal source fix before terminal RED and is not treated as hosted RED evidence.
• 525329b99a66681447d5ae404f021fc6a6431455 performs the local Agent Runtime session/execution preflight before selecting or reading a Workflow / Task Execution Durable Object, so a mismatched procedural session cannot be used to read another execution's workflow state.
• Current exact 5114729fac942b990368ccfb987f9d2ea267c1a3 also repairs the CHANGELOG and canonical PRD/TRD/architecture/ADR/adoption/baseline documentation findings without promoting source to deployed or activation truth.

Authority boundary

Workflow / Task Execution remains canonical for durable task/cancellation state. Agent Runtime remains canonical for lifecycle semantics. The new projection exists only to remove procedural advice when current durable workflow evidence proves cancellation, terminal work, or pre-start state. It cannot create task claims, lifecycle transitions, retries, tool capability, approval, provider routing, security/quarantine/outbound verdicts, publication, or foreign product truth. activationAuthorized: false and ADR-0017 Proposed remain unchanged.

The ACL validates the locally admitted procedural session against the re-admitted plan execution identity before the durable owner lookup. Cross-execution mismatch is therefore rejected at the Agent Runtime boundary without touching another execution-scoped Workflow / Task Execution object.

For non-workflow Agent Runtime executions, a separate fresh authenticated lifecycle source is still required. Source/fake-Durable-Object tests do not establish deployed Durable Object compatibility, restart behavior, availability, or synchronous buyer-path p95.

Current review state

Current-head COMMENT review at 5114729fac942b990368ccfb987f9d2ea267c1a3 found the previously recorded CHANGELOG and canonical documentation findings repaired and found no additional valid source/test/DDD/documentation finding. There are no unresolved inline review threads. This is not self-approval.

The exact current head has terminal-success application CI, reviewer-ci, central Security Scan, and patch-validator-image. Merge still requires a fresh live base/head recheck and normal merge; predecessor evidence is not transferable after any source mutation.

Acceptance

• exact current workflow evidence is re-read for every guidance decision; no cached caller-supplied running snapshot is accepted by this workflow-backed path;
• cross-execution plan/session mismatch is rejected before any execution-scoped durable owner lookup;
• malformed, conflicting, unavailable, cross-execution, cross-plan, foreign/duplicate task evidence fails closed;
• non-running evidence does not inspect the procedural request;
• owned production statement/branch coverage and public API documentation remain 100%;
• CHANGELOG and materially affected canonical documentation are code-current without claiming deployed p95, durable graph activation, or release evidence;
• unchanged exact head passes application CI, reviewer-ci, central Security Scan, and patch-validator-image;
• zero valid unresolved current-head findings before normal merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review at db172c3e483cb5c7036dd0c3aa7b37c8edeca962: the source/test boundary now reuses the existing execution-scoped Workflow / Task Execution Durable Object instead of introducing a second lifecycle store, and the fail-closed evidence matrix plus Proposed ADR/doctoring updates preserve the Agent Runtime vs Workflow / Task ownership split. Two documentation findings still block source-complete status: (1) this behavior change has no dedicated CHANGELOG.md ## Unreleased entry, contrary to the repository convention; (2) canonical root documentation such as PRD FR-024 still describes procedural guidance as relying only on a caller-supplied fresh lifecycle snapshot and says durable lifecycle freshness remains wholly future work. Repair those moving-current statements without flattening historical evidence. Keep this PR Draft until those docs are code-current and unchanged exact-head application CI, reviewer-ci, central Security Scan, and patch-validator-image are terminal GREEN.

[seonghobae]

Current-head review confirms the Agent Runtime/Workflow-Task ownership boundary is sound, but this exact is not source-complete yet. Two repair findings remain: (1) CHANGELOG.md has no dedicated ## Unreleased record for the new workflow-backed current-state ACL; (2) canonical moving-current docs still describe procedural execution as caller-snapshot-only and durable current-state/revocation as wholly absent. At minimum PRD FR-024/current runtime language and TRD §2.4 must distinguish the protected pure adapter from this candidate workflow-backed ACL, while preserving non-workflow freshness, deployed Durable Object, Policy/Approval, release and rollout gaps. These are repair findings, not a reason to close. Keep ADR-0017 Proposed and activationAuthorized: false.

[seonghobae]

Current-head source review at 525329b99a66681447d5ae404f021fc6a6431455: the new test-first cross-execution finding is causally repaired. The workflow plan is re-admitted, then the existing pure Agent Runtime gate validates the locally admitted procedural session against that execution identity before any NOEMA_WORKFLOW_STATE object is selected/read. The preflight uses accepted, so it does not inspect the procedural request; valid sessions then continue to the fresh durable read and the running-only advisory gate. I found no additional source/test authority defect in the five-file current diff. The previously recorded CHANGELOG and canonical PRD/TRD documentation findings remain open, so this head is still Draft/source-incomplete and should not merge yet.

[seonghobae]

Current-head review at 5114729fac942b990368ccfb987f9d2ea267c1a3: the previously recorded CHANGELOG and canonical PRD/TRD documentation findings are repaired on this exact head. The workflow-backed ACL remains read-only over the existing execution-scoped Workflow / Task Execution durable authority, rejects plan/session execution mismatch before durable lookup, re-reads current evidence for every decision, and keeps Agent Runtime lifecycle semantics plus activationAuthorized: false separate. ARCHITECTURE/PRD/TRD/ADR-0017/adoption/baseline describe #589 as candidate source rather than protected/deployed truth. I found no additional valid current-head source, test, DDD-boundary, or documentation finding in this diff. This is a COMMENT review, not self-approval; merge still requires fresh exact-head gate and base verification.