fix(agent-runtime): bind procedural evaluation receipt identities

[seonghobae]

Purpose

Prepare the next State / Checkpoint retention boundary without inventing persistence or approval authority. A locally branded ProceduralCandidateDecision now carries exact identities for the paired evaluation evidence it actually screened; graph/context digests alone are insufficient to bind later authenticated durable evidence to those exact observations.

Protected base: main@2013df113807f3214389b528e25a1a5de9d1b52d after normal #591 integration. ADR-0017 remains Proposed and every decision remains activationAuthorized:false.

RED → causal repair

• RED exact 393abf22a02749c16df0aac0a6ee17b64453e43e: focused tests require canonical baseline/candidate receipt digests and prove evidence changes alter the candidate receipt identity; the then-current source had no such fields.
• Source repair b49eb9f1f38cdad9e94707a70d4b25d29da84c4b: computes each receipt digest only after exact graph/context/case-set/score/safety validation, canonicalizes observations in admitted holdout order, and returns both digests inside the existing process-local branded frozen decision.
• Review repair adfe7fd4c943c21afe9f7b0c962520a0e006d545 → a839d0f52135e9921f4d3c10aa590a1ed9884e97: current-head review found the repository-wide CHANGELOG.md requirement was missing. The Unreleased entries now cover fix(agent-runtime): brand procedural screening decisions #591 process-local decision provenance and fix(agent-runtime): bind procedural evaluation receipt identities #592 receipt identity. Two accidental historical wording normalizations made while editing the large changelog were immediately restored; final diff against the prior source exact is two intended added bullets and zero historical deletions.
• Current exact d9c1f093fa23d255be3e605ad25bec09b8f1eaca: adds explicit safety-evidence identity coverage as well as score-change and observation-order canonicalization coverage.

The receipt digests are local evidence identities, not signatures, producer authentication, approval, persistence, activation, tool authority, provider routing, credentials, or foreign-domain truth. Later State / Checkpoint retention must still verify authenticated evaluator authority against these exact identities before durable reconstruction or Policy / Approval CAS.

Keep Draft until the unchanged current exact has application CI, reviewer-ci, central Security Scan, patch-validator-image and a fresh current-head review with no valid unresolved finding.

Summary by CodeRabbit

• 새로운 기능

  • 절차적 후보 평가 결과에 기준안과 후보안의 평가 영수증 식별자를 포함합니다.
  • 평가 영수증은 그래프, 평가 사례, 점수 및 안전성 검증 결과를 바탕으로 생성됩니다.
  • 평가 순서가 달라도 동일한 식별자를 유지하며, 평가 결과가 변경되면 관련 식별자도 갱신됩니다.

• 버그 수정

  • 안전성 위반이 감지된 후보는 safety_violation 사유로 처리됩니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ab1e824b-f10b-4ab2-9699-8611c93f346e

📥 Commits

Reviewing files that changed from the base of the PR and between 2013df1 and d9c1f09.

📒 Files selected for processing (3)

• CHANGELOG.md
• src/agent-runtime/procedural-evolution.ts
• test/procedural-evidence-identity.test.mjs

---

📝 Walkthrough

Walkthrough

Agent Runtime의 procedural candidate decision에 baseline 및 candidate 평가 영수증의 canonical SHA-256 digest를 추가합니다. 검증된 관측값으로 digest를 생성하고, 결정 객체에 저장하며, identity 불변성과 증거 변경 동작을 테스트합니다.

Changes

절차적 평가 영수증 identity

Layer / File(s)	Summary
영수증 digest 계약 및 생성 src/agent-runtime/procedural-evolution.ts, CHANGELOG.md	ProceduralCandidateDecision에 두 receipt digest 필드를 추가합니다. 그래프, 컨텍스트, holdout 케이스, 점수, 안전 위반 수를 포함하는 versioned SHA-256 digest를 생성합니다.
후보 결정 digest 통합 src/agent-runtime/procedural-evolution.ts	검증된 baseline 및 candidate 관측값으로 digest를 계산하고 frozen decision에 저장합니다.
영수증 identity 검증 test/procedural-evidence-identity.test.mjs	digest 형식과 상호 구별성을 검증합니다. 관측 순서 변경 시 동일성을 검증합니다. 점수 또는 안전 위반 변경 시 candidate digest만 변경되는 동작을 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/procedural-evidence-identity-20260910

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review found one repairable repository-contract finding on exact b49eb9f1f38cdad9e94707a70d4b25d29da84c4b: CONTRIBUTING.md and CLAUDE.md require every behavior change to update CHANGELOG.md under ## Unreleased, but this head changes the exported ProceduralCandidateDecision contract and currently changes only source + focused test. Keep the valid receipt-identity delta; add the narrow Unreleased entry without rewriting historical evidence, then rerun exact-head gates. Source semantics otherwise remain bounded: receipt digests are computed only after existing validation/canonical holdout ordering, remain local evidence identities rather than authentication/signature/approval, and activationAuthorized:false is unchanged.

[seonghobae]

Current-head review on exact d9c1f093fa23d255be3e605ad25bec09b8f1eaca: prior CHANGELOG finding is repaired without historical deletion, and the focused edge coverage now binds canonical observation order plus score and safety evidence changes. No valid unresolved source/test/DDD/documentation finding remains. Receipt digests are derived only after existing exact graph/context/case-set/score/safety validation, remain non-authenticating evidence identities, and do not change activationAuthorized:false or create State/Checkpoint, Policy/Approval, provider, tool, credential, or foreign-domain authority. Four exact-head workflows are terminal SUCCESS; no inline review threads are open.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.