fix(agent-runtime): brand procedural screening decisions

[seonghobae]

Purpose

Prevent a structurally forged ProceduralCandidateDecision from crossing the next State / Checkpoint or Policy / Approval authority boundary as if it had been produced by assessProceduralCandidate().

Protected main@dbc94effde5221c4ff03242d1e29c0e4e7b17422 has no open PRs and already contains #590 documentation convergence. ADR-0017 remains Proposed. This lane is a narrow prerequisite for durable rejection history / approval CAS: it does not add persistence, activation, provider routing, credentials, tool authority, or foreign-domain truth.

RED first

Exact da068a99e79e465036a927f6ceed21f873e88b7b adds a regression that requires locally screened decision provenance and rejects a frozen structural copy. It intentionally references the not-yet-implemented assertProceduralCandidateDecision() and therefore must not be treated as GREEN evidence.

Intended causal repair

Brand decisions inside procedural-evolution.ts only after all existing lineage/evaluation checks complete, expose a fail-closed assertion for later authority boundaries, and add a closed unadmitted_decision error code. A copied/frozen/proxy lookalike must never gain approval or persistence authority.

Keep Draft until the successor exact head has terminal application CI, reviewer-ci, central Security Scan, patch-validator-image and current-head review with no valid unresolved finding.

Summary by CodeRabbit

• 새로운 기능

  • 절차적 후보 결정에 대한 프로세스 내 검증이 강화되었습니다.
  • 공식 심사를 거치지 않은 변조·복제 결정은 승인되지 않으며, 명확한 오류로 처리됩니다.
  • 결정 결과는 활성화 권한을 자동으로 부여하지 않도록 제한됩니다.

• 문서

  • 오프라인 증거 심사와 결정 보존 시 필요한 신뢰 경계를 문서화했습니다.

• 테스트

  • 정상적인 심사 결과와 위조된 결정이 각각 올바르게 처리되는지 검증하는 테스트를 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 511b405a-48ef-40c0-95b0-e1666180182b

📥 Commits

Reviewing files that changed from the base of the PR and between dbc94ef and 2faef2c.

📒 Files selected for processing (4)

• docs/adr/0017-procedural-graph-guidance.md
• src/agent-runtime/procedural-evolution.ts
• src/agent-runtime/procedural-input.ts
• test/procedural-evolution.test.mjs

---

📝 Walkthrough

Walkthrough

프로시저 후보 결정에 프로세스 로컬 등록과 공개 검증 함수를 추가했습니다. 복제된 결정은 거부합니다. 관련 오류 코드를 추가하고, 검증 동작과 영속화 제한을 테스트와 ADR에 기록했습니다.

Changes

프로시저 결정 승인

Layer / File(s)	Summary
결정 등록 및 승인 검증 src/agent-runtime/procedural-evolution.ts, src/agent-runtime/procedural-input.ts	생성된 결정만 WeakSet에 등록합니다. assertProceduralCandidateDecision()은 등록되지 않은 객체를 unadmitted_decision 오류로 거부합니다. activationAuthorized는 false 리터럴로 고정합니다.
승인 경계 검증 및 지침 test/procedural-evolution.test.mjs, docs/adr/0017-procedural-graph-guidance.md	생성된 결정은 승인되고, 전개 연산으로 만든 결정은 거부되는지 검증합니다. 어댑터 호출 전 승인 검증과 별도 보존 증거 요구 사항을 문서화합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/procedural-decision-authority-20260910

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review on exact 2faef2c0d8337b00e241d648c0082ea36a68ada9: no valid unresolved source/test/DDD finding. The WeakSet provenance is granted only after the existing lineage/evaluation/safety/score checks complete; copied, deserialized, proxied, or caller-constructed lookalikes fail closed through unadmitted_decision; activationAuthorized remains false. This is process-local provenance only and does not mint evaluator authentication, persistence, approval, activation, provider routing, tool authority, credentials, or foreign-domain truth. Four exact-head workflows are terminal SUCCESS; no review threads are open.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.