feat(state-checkpoint): persist durable procedural evaluation history

[seonghobae]

Purpose

Implement the next Noema-owned #584 slice after protected #596: durable procedural evaluation/rejection history under the existing State / Checkpoint bounded context. This lane retains only payload-minimized exact graph/evaluation/authenticated signed-claim identities, uses monotonic CAS, preserves complete bounded history across restart, and makes the durable rejection set authoritative for later screening.

Reality RED → repair

Test-first exact 54ae12e6edc18a0ed6baa51c5fbd160631a89c37 introduced the durable-history contract before production source. After the adapter and duplicate-handoff integrity repair landed, exact c2ee6ba195182a1a8fb2da7d55656e66e45207c5 produced an observed application-CI RED in run 34482581525: all 4,575 tests passed, but global coverage fell to 99.98% because retained-history verification did not execute the previously_rejected integrity arm at src/state-checkpoint/procedural-evaluation-history.ts:222-223.

Causal successor 943d06defa6df274cb3b25d20861012725202f60 adds a focused restart/read regression for a persisted previously_rejected event rather than weakening the 100% gate. Successor 9e7237ed2fe92fca779aee2d7c30fce1f38b09b6 also records the State / Checkpoint behavior change under CHANGELOG.md ## Unreleased, as required by protected repository guidance. Hosted GREEN is claimed only from the final unchanged exact once observed.

Boundary

No second Workflow / Task or execution-lifecycle truth. No graph promotion/publication or Policy / Approval authority. activationAuthorized:false remains invariant. No Keyverse key custody/discovery, provider routing, quarantine/security/outbound truth, cross-service SQL, or mutable sibling dependency. The adapter consumes only locally admitted Noema graph/authenticated-evaluation authority and persists digest/reference evidence.

Draft until current exact has zero valid unresolved findings/threads and application CI, reviewer-ci, required central Security Scan, and patch-validator-image are terminal GREEN on the same head. Predecessor GREEN is not transferable.

Related: #584, #596.

Summary by CodeRabbit

• 새 기능

  • 인증된 절차 평가 및 거부 이력을 State/Checkpoint에 안전하게 저장하고 재구성합니다.
  • 동일한 평가 요청을 정확히 재생할 수 있으며, 이력 무결성과 그래프 계보를 검증합니다.
  • 최대 128개의 이벤트를 보존하고, 용량 초과나 충돌·위조·중복 기록을 안전하게 거부합니다.

• 문서

  • 미배포 변경 사항에 절차 평가 이력 저장 기능을 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: cc6058c1-4b45-41a3-9329-ccb92027fab6

📥 Commits

Reviewing files that changed from the base of the PR and between cde9cfa and 9e7237e.

📒 Files selected for processing (3)

• CHANGELOG.md
• src/state-checkpoint/procedural-evaluation-history.ts
• test/procedural-evaluation-history.test.mjs

---

📝 Walkthrough

Walkthrough

Agent Runtime에 인증된 procedural evaluation/rejection history를 State / Checkpoint에 저장하는 repository를 추가했습니다. Digest chain, monotonic CAS, exact replay, rejection projection, lineage, capacity, retained history integrity를 검증합니다.

Changes

Procedural evaluation history

Layer / File(s)	Summary
History schema and digest contract src/state-checkpoint/procedural-evaluation-history.ts	Stream, event, snapshot, append result 계약을 추가했습니다. 이벤트는 digest, handoff identity, rejection key, 고정된 activationAuthorized: false를 보존합니다.
Verified transactional repository src/state-checkpoint/procedural-evaluation-history.ts	Repository가 Durable Object transaction에서 lineage, CAS version, exact replay, rejection context, digest chain, handoff uniqueness, 128-event capacity를 검증합니다.
Authenticated history validation test/procedural-evaluation-history.test.mjs, CHANGELOG.md	저장 및 restart 복구, replay, stale writer, 잘못된 lineage, retained-byte corruption, duplicate handoff, capacity 초과를 검증하고 변경 사항을 기록합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant DurableProceduralEvaluationHistoryRepository
  participant DurableObjectStorage
  Caller->>DurableProceduralEvaluationHistoryRepository: 인증된 평가 append 요청
  DurableProceduralEvaluationHistoryRepository->>DurableObjectStorage: 현재 history transaction 조회
  DurableProceduralEvaluationHistoryRepository->>DurableProceduralEvaluationHistoryRepository: lineage와 digest chain 검증
  DurableProceduralEvaluationHistoryRepository->>DurableObjectStorage: CAS append 저장
  DurableProceduralEvaluationHistoryRepository-->>Caller: accepted 또는 exact replay 반환

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/procedural-evaluation-history-20260910

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review c2ee6ba195182a1a8fb2da7d55656e66e45207c5: two valid repair findings.

1. Application CI run 34482581525 is a real source/test RED, not infrastructure noise. All 4,575 tests pass, but the repository-wide 100% coverage gate fails because the retained-history verifier's previously_rejected arm at src/state-checkpoint/procedural-evaluation-history.ts:222-223 is not exercised. Repair with a focused restart/read regression that proves a persisted previously_rejected event reconstructs successfully; do not weaken or exclude coverage.
2. This PR changes production State / Checkpoint behavior but currently changes only source and test files. Protected CLAUDE.md/CONTRIBUTING.md require every behavior change to update CHANGELOG.md under ## Unreleased. Add the minimal current entry while preserving Noema State / Checkpoint ownership, the existing Workflow / Task and Policy / Approval boundaries, bounded no-eviction history, and activationAuthorized:false.

No self-approval. Re-review the causal successor exact after both repairs and require all four exact-head gates again.

[seonghobae]

Current-head re-review 9e7237ed2fe92fca779aee2d7c30fce1f38b09b6: the two prior findings are causally repaired. The retained previously_rejected integrity branch now has a restart/read regression, the State / Checkpoint behavior is recorded under CHANGELOG.md ## Unreleased, and the unchanged exact has application CI, reviewer-ci, central Security Scan, and patch-validator-image terminal SUCCESS. No unresolved inline review threads are present. I found no remaining valid source/test/docs/DDD/authority finding in the current three-file delta. activationAuthorized:false and the Workflow / Task, Policy / Approval, Keyverse/provider/security/outbound ownership boundaries remain intact. COMMENT only; no self-approval.