From 8bad02eb414e29fc1148e528918ad178e0649ffa Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 22:53:03 +0900 Subject: [PATCH 01/13] test(docs): require protected procedural history classification --- ...procedural-protected-documentation-contract.test.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/test/procedural-protected-documentation-contract.test.ts b/test/procedural-protected-documentation-contract.test.ts index 518ace86e..212961487 100644 --- a/test/procedural-protected-documentation-contract.test.ts +++ b/test/procedural-protected-documentation-contract.test.ts @@ -24,4 +24,14 @@ describe("protected procedural documentation authority", () => { expect(baseline).toContain("protected #585/#586/#589"); expect(adoption).toContain("#585, #586, and #589 are merged on protected `main`"); }); + + it("classifies durable procedural evaluation history as protected State / Checkpoint source", () => { + const adoption = document("docs/doctoring/procedural_graph_adoption.md"); + + expect(adoption).toContain("#597 is merged on protected `main`"); + expect(adoption).toContain("bounded durable evaluation/rejection history"); + expect(adoption).toContain("Policy / Approval CAS promotion/revocation remains separate authority"); + expect(adoption).not.toContain("Reuse existing execution/state authorities before adding persistence"); + expect(adoption).not.toContain("There is no production graph/trajectory store, signed receipt verifier"); + }); }); From 07e94ac8a4648efcb6cfea1cbc4d0899fd20bea9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 22:53:52 +0900 Subject: [PATCH 02/13] docs(agent-runtime): record protected procedural history --- docs/doctoring/procedural_graph_adoption.md | 61 ++++++++++++++------- 1 file changed, 42 insertions(+), 19 deletions(-) diff --git a/docs/doctoring/procedural_graph_adoption.md b/docs/doctoring/procedural_graph_adoption.md index 6ab711324..c3c50c5fc 100644 --- a/docs/doctoring/procedural_graph_adoption.md +++ b/docs/doctoring/procedural_graph_adoption.md @@ -6,17 +6,20 @@ Date: 2026-09-10. This record accompanies [ADR-0017](../adr/0017-procedural-graph-guidance.md), [Noema #584](https://github.com/ContextualWisdomLab/noema/issues/584), [core #585](https://github.com/ContextualWisdomLab/noema/pull/585), -[lifecycle #586](https://github.com/ContextualWisdomLab/noema/pull/586), and -[current-state ACL #589](https://github.com/ContextualWisdomLab/noema/pull/589). +[lifecycle #586](https://github.com/ContextualWisdomLab/noema/pull/586), +[current-state ACL #589](https://github.com/ContextualWisdomLab/noema/pull/589), and +[durable evaluation history #597](https://github.com/ContextualWisdomLab/noema/pull/597). The organization work item is [CWL #2067](https://github.com/ContextualWisdomLab/.github/issues/2067). The canonical EA adoption matrix belongs to enterprise-architecture-core, not this document. -Protected source integration: #585, #586, and #589 are merged on protected `main`. +Protected source integration: #585, #586, and #589 are merged on protected `main`; +#597 is merged on protected `main` as the State / Checkpoint durable-history slice. This is source-integration evidence only. ADR 0017 remains `Proposed`, candidate screening remains -`activationAuthorized: false`, and release, deployment, authenticated evaluation, durable promotion, -shadow/canary, rollback and product-outcome evidence remain separate authorities. The workflow-backed -current-state ACL is protected source; this record does not promote that source integration into -release, deployment, approval, or activation truth. +`activationAuthorized: false`, and release, deployment, live Keyverse trust selection, +Policy / Approval promotion/revocation, shadow/canary, rollback and product-outcome evidence remain +separate authorities. The workflow-backed current-state ACL and bounded durable evaluation/rejection +history are protected source; this record does not promote either source integration into release, +deployment, approval, graph publication, or activation truth. ## What the sources support @@ -42,6 +45,8 @@ than the blog's interpretation or comparative scores. | Unknown or oversized neighborhood | Return unavailable advice for `unknown_procedure` or `context_budget_exceeded`; do not turn abstention into success, return the entire graph, or silently drop prerequisite relationships. | | Execution lifecycle | The protected pure adapter accepts only a caller-supplied fresh authenticated lifecycle snapshot. For workflow-backed sessions, protected #589 re-reads the existing execution-scoped `NOEMA_WORKFLOW_STATE` owner before every guidance decision and suppresses advice when newer cancellation, terminal, or pre-start durable evidence exists. This is a conservative guidance projection, not a second Agent Runtime lifecycle store. | | Candidate comparison | Require exact base/candidate lineage, matching evaluation context, complete paired cases, disjoint train/holdout IDs and finite normalized scores. Reported candidate safety violations block eligibility regardless of mean gain. | +| Evaluation identity and authentication | Protected #592/#593 bind paired receipt semantics and evaluator/profile evidence into canonical digests; protected #594 verifies a separately authenticated P-256 ECDSA evaluator handoff selected by the composition root; protected #596 also binds rejection key, screening disposition and approval eligibility. These source contracts do not move Keyverse key custody or signer selection into Agent Runtime. | +| Durable evaluation/rejection history | Protected #597 stores only admitted graph/evaluation/authenticated signed-claim identities and bounded rejection evidence under State / Checkpoint. Monotonic CAS, exact replay, restart reconstruction, digest-chain integrity, duplicate-handoff refusal and fail-closed 128-event capacity preserve retained evidence without creating a second Workflow / Task or lifecycle truth. Policy / Approval CAS promotion/revocation remains separate authority. | | Independent acceptance | Arithmetic non-regression is not statistical significance, construct validity, standard setting or approval. Independent evaluation and final confirmation remain prerequisites. | | Data and secrets | No new credential, `.env` read, provider client, raw trajectory store or hidden-reasoning capture is introduced. Guidance text is still untrusted data; these modules do not detect prompt injection or scrub sensitive content. | @@ -100,16 +105,31 @@ and that exact PR head as parents. This proves source integration only; deployed Durable Object compatibility, restart behavior, availability and synchronous buyer-path latency remain separate evidence. +#597 introduced the State / Checkpoint retention slice test-first. Predecessor exact +`c2ee6ba195182a1a8fb2da7d55656e66e45207c5` produced a real application-CI RED: +all 4,575 tests passed, but the repository-wide 100% coverage gate exposed the +unexercised retained-history `previously_rejected` integrity arm. Causal successor +`943d06defa6df274cb3b25d20861012725202f60` added restart/read evidence for that +persisted disposition instead of excluding the branch from coverage, and +`9e7237ed2fe92fca779aee2d7c30fce1f38b09b6` added the required Unreleased behavior +record. The unchanged final exact then received terminal-success application CI, +reviewer CI, central Security Scan and patch-validator-image before normal merge as +`61f2b372d55c87e1763bc11d3e545967fc0a9cf5`. The merge preserves previous protected +main and the exact PR head as parents. This proves source integration and retained +State / Checkpoint semantics only; deployed Durable Object compatibility, Policy / +Approval promotion, production graph activation and measured task benefit remain +separate evidence. + ## Owner-led rollout and exit criteria | Stage | Responsible owner and concrete next delivery | Exit evidence | | --- | --- | --- | -| Source readiness | Noema: keep protected #585/#586/#589 behavior aligned with canonical docs without crossing Workflow / Task or Agent Runtime ownership. | Protected ancestry plus unchanged exact-head typecheck, full tests/coverage, applicable security/image checks and review. | +| Source readiness | Noema: keep protected #585/#586/#589/#597 behavior aligned with canonical docs without crossing Workflow / Task, Agent Runtime or Policy / Approval ownership. | Protected ancestry plus unchanged exact-head typecheck, full tests/coverage, applicable security/image checks and review. | | Interchange release | context-graph-contracts #28: graph/context/evaluation/decision schema, digest semantics and hostile conformance fixtures. | Immutable released contract and compatible independent consumer fixtures. Local `noema.procedural-graph/v1` is not already that release. | | Ownership inventory | enterprise-architecture-core #50: task/profile owner, consumer port, contract pin, evaluation profile and rollback owner for each applicable product. | Evidence distinguishes proposed, source, released, shadow, canary, active and rollback-tested. Deterministic kernels may be not applicable with a recorded reason. | | First shadow connection | contextual-orchestrator #1116 plus .github and Naruon owners: connect guide/solver roles through the existing gateway without write-side activation. | Observed matched no-graph/fixed-graph/evolved-graph runs; task success, sequencing errors, duplicate effects, cost/tokens and latency reported separately. | | Independent evaluation | psychometrics-commons #447: task stimuli, item/rubric definitions, paired evidence protocol, validation-search and untouched final confirmation separation. | Authenticated producer and exact graph/model/tool/dataset/rubric/context binding; justified evidence size and uncertainty; independent acceptance. | -| Offline state integration | Noema State/Checkpoint and Policy/Approval: minimized observations, candidate storage, scoped rejection retention, approval, compare-and-swap promotion, rollback and revocation. Reuse existing execution/state authorities before adding persistence. | Crash/replay/stale-writer tests and authentic approval/evidence references; running sessions keep their pinned revision and obey current revocation. | +| Durable state and approval | Noema State / Checkpoint and Policy / Approval: protected #597 provides bounded durable evaluation/rejection history under the existing state authority. Next bind exact graph/evaluation/signed-claim/history identity into independent Policy / Approval CAS promotion, rollback and revocation without making history itself approval authority. | Crash/replay/stale-writer history evidence plus authentic approval references; running sessions keep their pinned revision and obey current revocation. | | Product canary | Product owners: versioned adapter and domain-specific procedure/profile; no copied graph runtime. | Released contract conformance, observed invocation, domain regressions, independent side-effect controls and tested disable/rollback. | The first product scenarios are central review/finding verification and Naruon's @@ -135,16 +155,19 @@ lifecycle state and does not make Workflow / Task Execution the lifecycle owner. It only prevents a cached procedural `running` decision from surviving newer durable workflow evidence that proves cancellation, terminal work, or pre-start state. Non-workflow executions still need an authenticated current lifecycle source. The -deployed Durable Object read path also still needs real runtime compatibility/restart -evidence and buyer-path p95 measurement; source tests are not latency evidence. - -There is no production graph/trajectory store, signed receipt verifier, automatic -refiner, independently approved promotion API or product invocation in protected -source. There is also no evidence yet that graph guidance improves CWL tasks or meets -product latency targets. The owning root product/technical baseline must retain -these gaps and link this record without replacing historical results. Do not mark -ADR-0017 Accepted, publish a release, or advertise organization-wide activation -from source integration or the existence of tracking issues. +deployed Durable Object read path and the #597 durable-history path also still need +real runtime compatibility/restart evidence and buyer-path p95 measurement; source +and fake-Durable-Object tests are not latency evidence. + +Protected source now includes a separately authenticated signed evaluator-handoff +verifier and bounded durable evaluation/rejection history. It still has no production +graph/trajectory store, live Keyverse trust-selection wiring, automatic refiner, +independently approved graph promotion/revocation API, or product invocation. There +is also no evidence yet that graph guidance improves CWL tasks or meets product +latency targets. The owning root product/technical baseline must retain these gaps +and link this record without replacing historical results. Do not mark ADR-0017 +Accepted, publish a release, or advertise organization-wide activation from source +integration or the existence of tracking issues. ## References From 268765e2baefd916ec0ca2f82ca2550f76943c12 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 10 Sep 2026 23:04:53 +0900 Subject: [PATCH 03/13] test(docs): accept protected procedural history classification --- test/documentation-current-trust-authority.test.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index 287de2c60..4ff223d49 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -42,7 +42,10 @@ describe("current protected trust authority documentation", () => { const adoption = readFileSync("docs/doctoring/procedural_graph_adoption.md", "utf8"); expect(adoption).toContain( - "Protected source integration: #585, #586, and #589 are merged on protected `main`.", + "Protected source integration: #585, #586, and #589 are merged on protected `main`;", + ); + expect(adoption).toContain( + "#597 is merged on protected `main` as the State / Checkpoint durable-history slice.", ); expect(adoption).not.toContain( "Noema: complete #585 and #586, preserve parent-first ancestry and existing runtime boundaries.", From 299546e6da8b45804f2b94a930acd6142e41a885 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:06:43 +0900 Subject: [PATCH 04/13] test(docs): require protected procedural history in canonical docs --- ...umentation-current-trust-authority.test.ts | 20 +++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index 4ff223d49..f76f5d913 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -65,15 +65,27 @@ describe("current protected trust authority documentation", () => { expect(architecture).toContain("### 4.1 Protected procedural graph guidance"); expect(architecture).not.toContain("Active PR #585 adds"); + expect(architecture).toContain("bounded durable evaluation/rejection history"); + expect(architecture).not.toContain("protected procedural-graph source itself remains intentionally non-durable"); + expect(prd).toContain("Protected `main` includes a bounded **procedural graph advisory runtime** inside Agent Runtime."); expect(prd).not.toContain("Active PR #585 proposes"); + expect(prd).toContain("bounded durable evaluation/rejection history"); + expect(prd).toContain("separately authenticated signed evaluator-handoff verifier"); + expect(prd).not.toContain("graph/evaluation slice is intentionally non-durable"); + expect(prd).not.toContain("authenticated evaluation evidence, Policy / Approval, durable graph/rejection history"); + expect(trd).toContain("### 2.4 Protected procedural graph advisory runtime"); expect(trd).not.toContain("Active PR #585 adds"); expect(trd).not.toContain("## Candidate implementation — PR #585"); + expect(trd).toContain("bounded durable evaluation/rejection history"); + expect(trd).not.toContain("protected procedural graph source is intentionally non-durable"); + expect(uml).toContain("### 2.2 Protected procedural graph session, screening, and lifecycle projection"); expect(uml).not.toContain("procedural graph advisory\\ncandidate PR 585"); expect(uml).not.toContain("LIFE -. caller-supplied fresh authenticated lifecycle snapshot .-> PROC"); expect(uml).toContain("Agent Runtime boundary가 만든 fresh authenticated `ExecutionLifecycle` snapshot"); + expect(operability).not.toContain("Active #585 procedural graph source"); expect(operability).not.toContain("The #585 procedural graph candidate adds"); expect(testStrategy).not.toContain("The #585 procedural graph slice is library-only"); @@ -81,12 +93,16 @@ describe("current protected trust authority documentation", () => { expect(testStrategy).toContain("## 14. Credential-exchange coverage truth"); expect(testStrategy).toContain("test-first implement the smallest source fix"); expect(testStrategy).toContain("if the item is waiting, rotate to other safe work"); - expect(traceability).toContain("Implemented on protected main as advisory-only/non-durable source"); + + expect(traceability).toContain("bounded durable evaluation/rejection history"); + expect(traceability).not.toContain("Implemented on protected main as advisory-only/non-durable source"); expect(traceability).not.toContain("The first six steps are Noema Agent Runtime mechanics in the active #585 candidate"); expect(traceability).not.toContain("They do not authenticate the evaluator"); expect(traceability).toContain("Protected signed-handoff verification authenticates the supplied evaluator assertion"); - expect(baseline).toContain("## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589"); + + expect(baseline).toContain("## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589 + #597"); expect(baseline).not.toContain("## Active procedural graph advisory candidate — issue #584 / PR #585"); + expect(baseline).toContain("bounded durable evaluation/rejection history"); expect(baseline).toContain("ADR 0017도 `Proposed`다."); }); }); From 5aa3d4e2b5846340547f1a5b8e37a0ed0dce5cf4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:09:05 +0900 Subject: [PATCH 05/13] docs(agent-runtime): classify protected procedural evaluation history --- docs/PRD.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index 8a758b8b8..5751cf986 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -102,13 +102,15 @@ Protected `main` also includes the durable Workflow / Task Execution slice integ Protected source also includes the Noema-owned append-only external-extension lifecycle stream that grew from ADR 0015. Each stream is partitioned by the exact admitted extension/source/artifact identity; each transition binds monotonic version/state, prior-event/request/event SHA-256 evidence, exact Noema Policy / Approval and effective-scope identity, and immutable references/digests for AppGuardrail, quarantine/isolation, and Egress authority. A compact current projection verifies the exact durable tail for the synchronous path while full retained-prefix verification remains audit/recovery work. Exact duplicate requests are idempotent only after immutable replay verification, same-ID/different-semantics requests fail closed, and stale concurrent writers lose an expected-version/state/head CAS rather than being auto-rebased. A genuinely new `active` transition must re-read current Policy / Approval and owner evidence immediately before append; committed historical replay does not reconsult mutable authority. This implementation does not copy foreign scanner/runtime/outbound truth into Noema. Actual remote Durable Object performance, recovery, immutable owner-issued activation evidence, release, and deployment remain separate acceptance evidence rather than source-level claims. -Protected `main` includes a bounded **procedural graph advisory runtime** inside Agent Runtime. It admits immutable tenant/task-scoped graph snapshots, pins a locally admitted session to one canonical execution identity, returns only bounded local directed context or explicit abstention, and screens a direct child candidate against paired held-out evidence. Candidate screening always retains `activationAuthorized: false`: a non-regressing score is eligibility for a later independent approval boundary, not publication, tool, workflow, lifecycle, or activation authority. The protected graph/evaluation slice is intentionally non-durable and does not authenticate evaluation receipts, generate model edits, persist graph history, or implement canary/rollback. +Protected `main` includes a bounded **procedural graph advisory runtime** inside Agent Runtime. It admits immutable tenant/task-scoped graph snapshots, pins a locally admitted session to one canonical execution identity, returns only bounded local directed context or explicit abstention, and screens a direct child candidate against paired held-out evidence. Candidate screening always retains `activationAuthorized: false`: a non-regressing score is eligibility for a later independent approval boundary, not publication, tool, workflow, lifecycle, or activation authority. + +Protected source now also includes exact paired evaluation-receipt identities, evaluator-envelope binding, and a separately authenticated signed evaluator-handoff verifier. The verifier authenticates a composition-root-selected P-256 ECDSA evaluator assertion without importing signer-key custody into Agent Runtime. Protected #597 adds bounded durable evaluation/rejection history under the existing State / Checkpoint boundary: admitted graph/evaluation/signed-claim identities and minimized rejection evidence are retained with monotonic CAS, exact replay, digest-chain integrity, duplicate-handoff refusal, restart reconstruction, and fail-closed bounded capacity. This retained history is evidence state only; it is not graph publication, Policy / Approval, activation, tool, retry, workflow, or product-domain authority. Protected source also includes the #586 execution-lifecycle adapter. It projects procedural guidance only when the caller supplies a fresh authenticated `running` lifecycle snapshot for the same canonical execution identity and suppresses guidance for accepted, cancellation-requested, or terminal states. The adapter is not itself durable lifecycle/revocation authority and cannot prove that a canonical `running` snapshot has not become stale after the caller obtained it. Protected source includes the #589 workflow-backed current-state ACL without replacing that pure adapter. It re-admits the workflow plan, validates the locally admitted procedural session against the same canonical execution identity before selecting any execution-scoped Durable Object, then re-reads the existing Workflow / Task Execution owner before each guidance decision. Current cancellation, terminal task evidence, and pre-start evidence suppress guidance; only other current nonterminal workflow evidence can reach the existing running-only advisory gate. This protected ACL does not make Workflow / Task Execution the Agent Runtime lifecycle store and does not grant mutation, retry, Policy / Approval, tool, release, or activation authority. Non-workflow Agent Runtime callers still require their own fresh authenticated lifecycle source, and source/fake-Durable-Object tests do not establish deployed Durable Object compatibility, restart behavior, availability, or synchronous buyer-path p95. -Procedural graph ownership follows existing CWL boundaries. Any released cross-service schema belongs to `context-graph-contracts`; enterprise adoption/decision records belong to `enterprise-architecture-core`; model discovery/routing remains in `contextual-orchestrator`; credentials remain in Keyverse; graph content and outcome/evaluation truth remain with the consuming product. Noema owns only the execution-local advisory mechanics and deterministic candidate-screening port. Mutable sibling PR heads are not production dependencies. +Procedural graph ownership follows existing CWL boundaries. Any released cross-service schema belongs to `context-graph-contracts`; enterprise adoption/decision records belong to `enterprise-architecture-core`; model discovery/routing remains in `contextual-orchestrator`; credentials and live signer trust selection remain in Keyverse/owner composition; graph content and outcome/evaluation truth remain with the consuming product. Noema owns only the execution-local advisory mechanics, deterministic candidate-screening/evaluation binding, and bounded State / Checkpoint history needed to retain its own evidence. Mutable sibling PR heads are not production dependencies. ADR 0017 remains `Proposed`; source integration does not authorize release, graph publication, canary, rollback, Policy / Approval, or activation. ## 5. Functional requirements @@ -137,7 +139,7 @@ Procedural graph ownership follows existing CWL boundaries. Any released cross-s | FR-021 | Model discovery, routing, test-time compute, provider failover, and provider credentials remain owned by `contextual-orchestrator`; Noema runtime code must not duplicate direct provider SDKs, credentials, fallback lists, or routing policy. | | FR-022 | Workflow/task, tool/capability, isolation, policy/approval, observability, recovery, Context Graph, and EA integration must cross explicit versioned ports/contracts; Context Graph integration must use immutable released versioned contracts, reject open or unreleased Draft contracts, and require conformance/admission evidence, canonical object/authority references, provenance, and valid/system time semantics. Arbitrary tool authority, ambient secret propagation, unbounded recursive work, silent side-effect retry, unreleased Context Graph source coupling, and cross-service SQL are forbidden. | | FR-023 | External-extension lifecycle authority must be append-only, exact-stream partitioned, restart-reconstructable, and CAS-serialized; current projection must be cryptographically bound to its audit tail, full audit must detect sequence/hash/stream truncation or substitution, exact duplicate replay must preserve committed history, and every genuinely new activation must bind a fresh Noema Policy / Approval and owner-evidence re-read without copying foreign-owner truth. | -| FR-024 | Procedural graph guidance must remain tenant/task/execution scoped, immutable and advisory-only; reject forged graph/session identities and unsafe input, return bounded localized context or explicit abstention, bind candidate screening to exact direct-child lineage and paired held-out context, prevent train/holdout leakage, reject safety or measured-score regression, and keep activation unauthorized. The protected pure adapter requires a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot. For protected workflow-backed guidance, the plan/session execution identity must match before any execution-scoped durable lookup and the canonical Workflow / Task Execution owner must be re-read before every decision. Non-workflow lifecycle freshness, released contracts, authenticated evaluation evidence, Policy / Approval, durable graph/rejection history, deployment evidence and rollout authority remain separate prerequisites. | +| FR-024 | Procedural graph guidance must remain tenant/task/execution scoped, immutable and advisory-only; reject forged graph/session identities and unsafe input, return bounded localized context or explicit abstention, bind candidate screening to exact direct-child lineage and paired held-out context, prevent train/holdout leakage, reject safety or measured-score regression, and keep activation unauthorized. Protected source must bind evaluation receipts/envelopes to exact identities, verify authenticated evaluator handoff without owning signer custody, and retain bounded evaluation/rejection history only under the existing State / Checkpoint authority. The pure adapter still requires a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot; workflow-backed guidance must match plan/session execution identity before any durable lookup and re-read canonical Workflow / Task Execution state before every decision. Live Keyverse/owner trust selection, non-workflow lifecycle freshness, released contracts, Policy / Approval CAS promotion/revocation, deployed durable compatibility/performance, graph publication, canary/rollback and product-outcome authority remain separate prerequisites. | ## 6. Non-functional requirements @@ -195,7 +197,7 @@ Protected source can establish implementation contracts, deterministic tests, pa - 30-day production KPI evidence; - immutable release publication and deployment success unless those events actually occur; - customer/pilot, revenue/pipeline, support ownership, owner/legal rights, or contributor/IP transfer authority; -- authenticated procedural-evaluation provenance, durable procedural graph history/current-lifecycle revocation, independent approval, canary/rollback success, or product-outcome improvement merely because a graph digest or `eligibleForApproval` result exists. +- live procedural signer/trust selection, non-workflow lifecycle freshness, Policy / Approval promotion/revocation, production graph publication, deployed durable-history compatibility/performance, canary/rollback success, or product-outcome improvement merely because protected source can authenticate evaluator handoff and retain bounded evaluation/rejection history. Those remain separate external or later-stage evidence and must fail closed when required but absent. @@ -218,7 +220,7 @@ An earlier stage never proves a later stage. - generalizing the narrow short-lived Actions App-token capability-file bootstrap into an ambient or long-lived secret transport mechanism; - inventing trust controls or deployment evidence absent from the owning source/live system; - creating direct cross-service application-database coupling; -- treating procedural graph content, digest identity, candidate non-regression, or `eligibleForApproval` as tool, lifecycle, Policy / Approval, publication, or activation authority; +- treating procedural graph content, digest identity, candidate non-regression, authenticated evaluator handoff, retained history, or `eligibleForApproval` as tool, lifecycle, Policy / Approval, publication, or activation authority; - fabricating release, deployment, KPI, customer, revenue, licensing, ownership, or certification evidence; - adding a physical relational ERD before Noema owns such persistence. From ef8d5ce5de40479c2b28474c463d73e713942585 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:10:50 +0900 Subject: [PATCH 06/13] docs(agent-runtime): align TRD with durable procedural history --- docs/TRD.md | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index ad46e54f6..1484f30eb 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -58,15 +58,17 @@ Protected source includes four library-only Agent Runtime modules: `procedural-i `createProceduralGraph()` produces a deep-frozen tenant/task/graph snapshot and registers it in a module-local admission set. `startProceduralSession()` requires that admitted graph plus exact tenant/task/execution/digest agreement and returns an execution-pinned, locally admitted session. Directed neighborhood traversal is cycle-safe and bounded by hops/edge count; unknown procedures and exhausted context budgets return explicit abstention with no hidden full-graph fallback. Graph text stays inert `advisory_only` data and grants no tool, retry, lifecycle, Policy / Approval, credential, or product-domain authority. -`assessProceduralCandidate()` accepts only an admitted direct-child graph, exact evaluation-context digest, disjoint training/held-out case identities, complete paired baseline/candidate observations, finite normalized scores and explicit safety-violation counts. It rejects lineage/context mismatch, train/holdout leakage, missing/duplicate cases, any candidate safety violation, mean score regression, repeated rejection keys and unchanged structure. A passing result is only `eligibleForApproval`; `activationAuthorized` is always `false`. Receipt authentication, durable graph/rejection history, approval CAS, canary/rollback and production outcome measurement are deliberately later boundaries. +`assessProceduralCandidate()` accepts only an admitted direct-child graph, exact evaluation-context digest, disjoint training/held-out case identities, complete paired baseline/candidate observations, finite normalized scores and explicit safety-violation counts. It rejects lineage/context mismatch, train/holdout leakage, missing/duplicate cases, any candidate safety violation, mean score regression, repeated rejection keys and unchanged structure. A passing result is only `eligibleForApproval`; `activationAuthorized` is always `false`. + +Protected source extends that screening boundary with exact paired evaluation-receipt identities, canonical evaluator-envelope binding, and a separately authenticated P-256 ECDSA evaluator-handoff verifier selected by the composition root. It binds evaluation context, dataset/rubric/model/tool/protocol/validation-plan evidence and rejection/disposition semantics without moving signer-key custody, trust selection, or private keys into Agent Runtime. Protected #597 then adds bounded durable evaluation/rejection history under the existing State / Checkpoint boundary. Only admitted graph/evaluation/authenticated signed-claim identities and payload-minimized rejection evidence are retained, with monotonic CAS, exact replay, digest-chain verification, duplicate-handoff refusal, restart reconstruction, and fail-closed bounded capacity. History retention is evidence state, not Policy / Approval or activation authority. `guideProceduralExecution()` consumes only a locally admitted procedural session and a caller-supplied fresh authenticated lifecycle snapshot for the same canonical execution identity. It projects bounded advisory context only while that supplied lifecycle is `running`; accepted, cancellation-requested and terminal states suppress guidance. This pure adapter does not persist lifecycle state and cannot independently prove that a previously authenticated `running` snapshot has not become stale. Protected source `guideProceduralExecutionFromCurrentWorkflowState()` provides a workflow-backed freshness ACL without changing the pure adapter's ownership. It first re-admits the workflow plan and validates the locally admitted procedural session against that exact execution identity before any Durable Object is selected or read. It then issues only the existing private Workflow / Task Execution `read` command to the execution-scoped `NOEMA_WORKFLOW_STATE` owner, validates exact execution/plan identity, complete unique task identities, allowed task states, cancellation identity and transition sequence, and projects only the minimum Agent Runtime state needed for the existing running-only advisory gate. Cancellation and terminal work suppress guidance, initialized pre-start evidence remains unavailable, and other current nonterminal workflow evidence may be treated as running for advisory purposes. The ACL cannot claim/mutate tasks, create lifecycle transitions, retry effects, grant Policy / Approval or tool authority, or replace Agent Runtime lifecycle semantics. Cross-execution plan/session mismatch is rejected before another execution's durable owner can be read. -This protected ACL closes only the cached-workflow-snapshot gap for workflow-backed executions at source level. Non-workflow Agent Runtime callers still require their own fresh authenticated lifecycle source. Fake/in-memory Durable Object tests do not establish deployed transaction compatibility, restart/failure behavior, availability, synchronous buyer-path p95, durable procedural graph/rejection history, approval CAS, canary/rollback, release, deployment, or activation evidence. +This protected ACL closes only the cached-workflow-snapshot gap for workflow-backed executions at source level. Non-workflow Agent Runtime callers still require their own fresh authenticated lifecycle source. Fake/in-memory Durable Object tests do not establish deployed transaction compatibility, restart/failure behavior, availability, synchronous buyer-path p95, Policy / Approval CAS, graph publication, canary/rollback, release, deployment, or activation evidence. The #597 history path also still requires real Durable Object compatibility/restart/failure and latency evidence before it can be treated as production-operable persistence. -Released cross-service procedural graph schemas belong to `context-graph-contracts`; enterprise adoption records belong to `enterprise-architecture-core`; model discovery/routing remains owned by `contextual-orchestrator`; credentials remain in Keyverse; graph content and product outcome truth remain with the consuming product. No mutable sibling PR-head dependency is accepted as production authority. ADR 0017 remains `Proposed`: protected source integration is not release, deployment, approval, canary or activation evidence. +Released cross-service procedural graph schemas belong to `context-graph-contracts`; enterprise adoption records belong to `enterprise-architecture-core`; model discovery/routing remains owned by `contextual-orchestrator`; credentials and live signer trust selection remain in Keyverse/owner composition; graph content and product outcome truth remain with the consuming product. No mutable sibling PR-head dependency is accepted as production authority. ADR 0017 remains `Proposed`: protected source integration, authenticated evaluator verification, and bounded State / Checkpoint retention are not release, graph publication, Policy / Approval, canary or activation evidence. ## 3. Identity and revision semantics @@ -309,7 +311,7 @@ Deterministic Node/npm과 lockfile control은 protected main의 `.github/lockfil - reviewer Python: line/branch 100%, public docstrings 100%. - workflow/document contracts: shipped YAML/docs/source 관계를 executable tests로 검증. - security: hostile input, stale identity, partial pagination, duplicate keys, symlink/race, provider/network failure 포함. -- procedural graph protected source: exact-key descriptor-safe input, forged/copied/proxy graph/session rejection, canonical digest/order behavior, cycle-safe bounded traversal, unknown/budget abstention, direct-child lineage, paired held-out completeness, train/holdout leakage, invalid score/safety regression, rejection replay, `activationAuthorized: false`, same-execution lifecycle gating and non-running suppression must remain executable regressions. +- procedural graph protected source: exact-key descriptor-safe input, forged/copied/proxy graph/session rejection, canonical digest/order behavior, cycle-safe bounded traversal, unknown/budget abstention, direct-child lineage, paired held-out completeness, train/holdout leakage, invalid score/safety regression, rejection replay, `activationAuthorized: false`, signed evaluator-envelope/handoff identity and expiry, durable history CAS/replay/integrity/restart/capacity behavior, same-execution lifecycle gating and non-running suppression must remain executable regressions. - numerical/psychometric 계산이 추가되면 Rust-first CPU reference와 material GPU parity를 별도 requirement로 적용합니다. 자세한 내용은 `docs/TEST_STRATEGY.md`를 따릅니다. @@ -341,13 +343,13 @@ Deployment는 protected environment/governance, active runtime identity, traffic Protected external-extension lifecycle persistence owns exact-stream event records, transition-id replay index, and compact head projection. This storage is append-only for lifecycle events and is semantically separate from the bounded Workflow / Task transition-receipt ledger. It persists Noema lifecycle decision evidence plus immutable foreign-owner references/digests, never editable foreign-owner truth. Real Durable Object performance/recovery and immutable activation-owner evidence remain operational acceptance work. -The protected procedural graph source is intentionally non-durable: graph/session admission, candidate screening, and execution-lifecycle projection remain process-local immutable authority values. A graph digest, structure digest, rejection key, `eligibleForApproval` result, or caller-supplied lifecycle snapshot must not be promoted into durable activation authority. Any later store must define versioned schema, append/CAS/idempotency, authenticated receipt provenance, current-lifecycle/revocation semantics, retention/recovery, approval binding and rollback separately before it can authorize rollout. +The procedural graph/session and candidate-decision authorities remain process-local immutable values, but protected #597 now owns bounded durable evaluation/rejection history under the existing State / Checkpoint boundary. The retained history binds admitted graph/evaluation/authenticated signed-claim identities and minimized rejection evidence with monotonic CAS, exact replay, digest-chain integrity, restart reconstruction, duplicate-handoff refusal, and fail-closed bounded capacity. Neither a process-local graph digest nor a retained history event is durable activation authority: live signer trust, Policy / Approval promotion/revocation, graph publication, current lifecycle/revocation, canary/rollback and product-owner outcome evidence remain separate authorities. ## Protected procedural implementation -Protected source implements procedural graph admission/session, offline direct-child candidate screening, and the #586 lifecycle-gated advisory projection with hostile tests for malformed descriptors, forged local authority, graph identity/scope, resource bounds, cycle-safe traversal, abstention, lineage/context mismatch, train/holdout leakage, paired evidence completeness, safety regression, measured-score regression, same-execution lifecycle binding, and non-running suppression. ADR 0017 remains `Proposed`; root architecture and traceability retain graph content as advisory-only and activation as unauthorized. This source is not a deployed route, durable graph store, model refiner, signed receipt verifier, automatic activation system, current-state revocation authority, or organization rollout. +Protected source implements procedural graph admission/session, offline direct-child candidate screening, exact paired evaluation-receipt/envelope identities, separately authenticated signed evaluator handoff, bounded State / Checkpoint evaluation/rejection history, and the #586 lifecycle-gated advisory projection with hostile tests for malformed descriptors, forged local authority, graph identity/scope, resource bounds, cycle-safe traversal, abstention, lineage/context mismatch, train/holdout leakage, paired evidence completeness, safety regression, measured-score regression, signed claim/disposition binding, history replay/integrity/restart/capacity, same-execution lifecycle binding, and non-running suppression. ADR 0017 remains `Proposed`; root architecture and traceability retain graph content as advisory-only and activation as unauthorized. This source is not a deployed route, production graph store, automatic refiner, live Keyverse trust-selection owner, Policy / Approval promotion/revocation API, automatic activation system, or organization rollout. -Protected source reuses the Workflow / Task Execution Durable Object only as current task/cancellation evidence for procedural guidance through the #589 workflow-backed current-state ACL. It does not persist procedural graphs or create a second lifecycle database, and it validates local session/execution identity before any execution-scoped durable read. This protected ACL narrows stale workflow-backed guidance at source level but does not establish deployed Durable Object behavior, universal lifecycle freshness, Policy / Approval promotion, or rollout authority. +Protected source reuses the Workflow / Task Execution Durable Object only as current task/cancellation evidence for procedural guidance through the #589 workflow-backed current-state ACL. It does not create a second lifecycle database, and it validates local session/execution identity before any execution-scoped durable read. This protected ACL narrows stale workflow-backed guidance at source level but does not establish deployed Durable Object behavior, universal lifecycle freshness, Policy / Approval promotion, or rollout authority. ## Implemented @@ -356,7 +358,7 @@ Protected source reuses the Workflow / Task Execution Durable Object only as cur - Worker routing, OIDC/GitHub App exchange, bounded request/egress controls. - distributed rate-limit and OIDC replay Durable Objects. - external-extension admission and append-only lifecycle storage/runtime binding, while real-backend operational/activation evidence remains separate. -- procedural graph local admission/session, deterministic direct-child screening, lifecycle-gated advisory projection, and workflow-backed current-state ACL while durable revocation/approval/rollout evidence remains separate. +- procedural graph local admission/session, deterministic direct-child screening, authenticated evaluator-envelope/handoff binding, bounded durable evaluation/rejection history, lifecycle-gated advisory projection, and workflow-backed current-state ACL while live trust selection, Policy / Approval, deployed durability/latency, graph publication and rollout evidence remain separate. - central-review/commercial-readiness/product-development/readiness/acquisition workflow 계열과 policy/test 기반. - evidence-class separation을 반영한 maintenance policy code. - configured 100% production coverage and reviewer-quality gates. @@ -370,7 +372,7 @@ Protected source reuses the Workflow / Task Execution Durable Object only as cur - issue #30의 organization-level runner-assignment root-cause evidence. - release/deployment provenance chain의 실제 production acceptance. - external-extension lifecycle actual Durable Object current-projection/contended-append p95 measurement, partition/lock/storage-growth capture, full audit rebuild, backup/restore or equivalent recovery rehearsal, and rollback/suspension verification before ADR 0015 can advance. -- released procedural wire-contract work, authenticated evaluation receipts, durable graph/rejection history and non-workflow current-lifecycle/revocation authority, deployed workflow-state ACL evidence, Policy / Approval CAS, canary/rollback evidence, and product-owner production outcome measurement before ADR 0017 can advance beyond its current Proposed/advisory-only state. +- released procedural wire-contract work, live Keyverse/owner trust-selection wiring, Policy / Approval CAS promotion/revocation, non-workflow current-lifecycle/revocation authority, deployed workflow-state and #597 durable-history compatibility/restart/failure/p95 evidence, graph publication, canary/rollback evidence, and product-owner production outcome measurement before ADR 0017 can advance beyond its current Proposed/advisory-only state. ## External evidence @@ -382,7 +384,7 @@ repository source만으로 충족되지 않는 항목: - private vulnerability-reporting repository setting and benign exercise where required. - production environment protection and independent reviewer configuration. - production KPI/log provenance, deployment receipts/attestations. -- procedural graph evaluator identity/receipt authenticity, enterprise adoption approval, non-workflow durable current-state/canary/rollback evidence, deployed workflow-state ACL behavior, and product outcome truth from their owning systems. +- live procedural signer/trust selection, enterprise adoption approval, non-workflow current-state/revocation evidence, deployed Workflow / Task and durable-history compatibility/performance, Policy / Approval promotion/revocation, canary/rollback evidence, and product outcome truth from their owning systems. ## 17. References From e266c423d18cc7d31a5a821418719d56e6f87e0e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:12:05 +0900 Subject: [PATCH 07/13] docs(agent-runtime): align architecture with procedural history authority --- ARCHITECTURE.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 0da8d461b..55559fc14 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -94,7 +94,9 @@ Protected source `src/agent-runtime/procedural-current-lifecycle.ts` provides a The aggregate deliberately owns only Noema runtime mechanics. Procedural text is inert advisory data and is not tool authority, Policy / Approval, a prompt-injection verdict, a secret/PII scrubber, or product-domain truth. Graph/session WeakSet admission prevents structural lookalikes from becoming local runtime capabilities. Unknown procedures and context-budget overflow abstain without a hidden full-graph fallback. Execution identities reuse the canonical Agent Runtime grammar rather than defining a second identity domain. -Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials to Keyverse, and graph content/evaluation truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration does not establish authenticated evaluation receipts, durable graph history, non-workflow current-lifecycle revocation, Policy / Approval CAS, deployed Durable Object behavior, canary/rollback evidence, production activation, or organization-wide self-evolution. +Protected source also binds paired evaluation receipts and evaluator/profile context into canonical evaluation identities, verifies a separately authenticated P-256 ECDSA evaluator handoff selected by the composition root, and binds rejection/disposition semantics into the signed claim identity. The verifier does not discover, rotate, store, or administer signer keys. Protected #597 adds bounded durable evaluation/rejection history under the existing State / Checkpoint boundary with monotonic CAS, exact replay, digest-chain integrity, duplicate-handoff refusal, restart reconstruction, and fail-closed bounded capacity. The retained history is evidence state only; it does not become Policy / Approval, graph publication, lifecycle, or activation authority. + +Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials and live signer trust selection to Keyverse/owner composition, and graph content/evaluation outcome truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration does not establish live trust selection, non-workflow current-lifecycle revocation, Policy / Approval CAS, deployed Durable Object behavior/performance, graph publication, canary/rollback evidence, production activation, or organization-wide self-evolution. ## 5. Evidence and authority separation @@ -142,7 +144,9 @@ Durable Object alarms are at-least-once. Handlers reread current deadline/expiry Protected source includes separate Durable Object storage semantics for external-extension lifecycle evidence. The event log is append-only and is not the bounded Workflow / Task receipt ledger. Event/request digests are computed outside the short transaction; the transaction revalidates expected version, prior state, and prior head digest before atomically writing event + idempotency index + compact head. `readCurrent()` verifies only the head and exact tail for the latency-sensitive path, whereas `readAudit()` verifies every retained version/hash link and final head/tail identity. Corrupt or truncated durable state is a conflict, never an empty stream. Recovery and rollback must preserve acknowledged history and follow `docs/external-extension-lifecycle-recovery.md`. -The protected procedural-graph source itself remains intentionally non-durable. A graph digest or successful held-out screen is not retained activation authority. Protected #589 reuses the existing durable Workflow / Task Execution state only as current task/cancellation evidence for workflow-backed advisory gating; it does not persist graph history, approval, or activation state and does not replace Agent Runtime lifecycle ownership. Durable graph/rejection history, authenticated evaluation receipts, non-workflow current-lifecycle revocation, approval CAS, canary state, rollback and recovery require later owner-approved boundaries; adding those concerns directly to the library aggregate would collapse State / Checkpoint, Policy / Approval, and product-domain ownership. +Procedural graph/session and candidate-decision authority remain process-local immutable values. In contrast, protected #597 owns bounded durable evaluation/rejection history under the existing State / Checkpoint boundary. It persists only admitted graph/evaluation/authenticated signed-claim identities and payload-minimized rejection evidence, validates monotonic CAS and exact replay, verifies the retained digest chain, reconstructs after restart, rejects duplicate handoff identity, and fails closed at its bounded capacity instead of silently evicting evidence. A retained history event is not retained activation authority: live signer trust, Policy / Approval promotion/revocation, graph publication, non-workflow lifecycle freshness/revocation, canary/rollback and product-owner outcome evidence remain separate owner-controlled boundaries. + +Protected #589 separately reuses the existing durable Workflow / Task Execution state only as current task/cancellation evidence for workflow-backed advisory gating. It does not create another lifecycle store and does not turn Workflow / Task Execution into procedural-history authority. This separation keeps State / Checkpoint evidence retention, Workflow / Task current execution truth, Policy / Approval, and product-domain ownership distinct. ## 9. Standalone and modular MSA contract @@ -161,7 +165,7 @@ The protected procedural-graph source itself remains intentionally non-durable. | OIDC/GitHub App | issuer/audience/repository/workflow-ref, immutable workflow-source SHA when configured, malformed token/JWKS, replay, redirect/egress, secret non-disclosure regressions | | Durable Objects | cross-instance semantics, delayed/retried alarm, current-state reschedule, malformed backend/storage-failure tests | | External-extension lifecycle | legal-edge validation; restart/replay/CAS races; exact Policy / Approval and foreign-owner reference binding; corruption/truncation/cross-stream rejection; >128-transition auditability; O(1) verified current projection; full audit/recovery rehearsal; actual Durable Object p95/contention/storage-growth evidence before runtime acceptance | -| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; pure same-execution fresh lifecycle projection; workflow-backed plan/session identity rejection before durable lookup plus fresh current Workflow / Task Execution read per decision; later authenticated receipt/durable graph/non-workflow revocation/approval/canary/deployed-DO evidence before activation | +| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; exact receipt/envelope and authenticated evaluator-handoff binding; durable history CAS/replay/integrity/restart/capacity; pure same-execution fresh lifecycle projection; workflow-backed plan/session identity rejection before durable lookup plus fresh current Workflow / Task Execution read per decision; live trust selection/non-workflow revocation/Policy-Approval/deployed-DO/graph-publication/canary evidence before activation | | GitHub Actions/control plane | least privilege, exact-head/live-base binding, full pagination, stale-head refusal, evidence-class separation | | LLM integration | gateway contract, provider-key isolation, deterministic gates independent of model judgement | | release/acquisition | protected source, CI/security/coverage, package/SBOM/provenance/reproducibility, licensing/NOTICE, rollback/recovery, later operational/buyer evidence | @@ -174,7 +178,7 @@ Repository source/docs cannot fabricate stronger live `main` governance than the Protected external-extension lifecycle source cannot establish actual Durable Object p95, contention/partition behavior, backup/restore success, production recovery, or deployed invocation enforcement by documentation alone. Those remain later exact operational evidence. -Protected procedural-graph source, including #589, cannot establish authenticated evaluation provenance, cross-language/released digest semantics, durable graph version history, non-workflow current-lifecycle revocation, approval, deployed workflow-state ACL behavior, canary operation, rollback success, or production outcome improvement. Those remain later contract, Policy / Approval, operational, and product-owner evidence. +Protected procedural-graph source can authenticate the supplied evaluator assertion and retain bounded evaluation/rejection history, but it cannot establish live signer/trust selection, cross-language/released digest semantics, non-workflow current-lifecycle revocation, Policy / Approval promotion/revocation, deployed Workflow / Task or history-store behavior/performance, graph publication, canary operation, rollback success, or production outcome improvement. Those remain later owner, contract, Policy / Approval, operational, and product-owner evidence. ## 12. Canonical documentation graph @@ -199,6 +203,6 @@ The default shape is **small credential-exchange service + explicit state coordi The external-extension lifecycle remains a bounded Tool Capability / State / Checkpoint aggregate rather than a new scanner, quarantine runtime, egress engine, identity provider, or model router. Its synchronous projection path and full audit/recovery path are deliberately separate so buyer/runtime latency does not require scanning retained history while recovery still verifies the complete chain. -The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. Its pure execution adapter may project localized context against a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot. Protected #589 adds only a workflow-backed current-state ACL: it reuses the existing canonical Workflow / Task Execution durable owner for fresh task/cancellation evidence and rejects plan/session execution mismatch before durable lookup. Any future graph persistence, release, approval, non-workflow current-lifecycle revocation, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized: false` until those independent authorities are proven. +The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. Its pure execution adapter may project localized context against a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot. Protected #589 adds only a workflow-backed current-state ACL over the existing canonical Workflow / Task Execution owner. Protected #597 adds a separate bounded State / Checkpoint history for evaluation/rejection evidence, not a second Workflow / Task or lifecycle truth. Any future release, live signer-trust selection, Policy / Approval promotion/revocation, graph publication, non-workflow current-lifecycle revocation, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized: false` until those independent authorities are proven. Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth. From 80d7d9bee90d82661b601644d3d8d5d27eac1fe3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:14:58 +0900 Subject: [PATCH 08/13] docs(agent-runtime): trace protected procedural history --- docs/TRACEABILITY.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md index 68d6dbf63..dc1a88729 100644 --- a/docs/TRACEABILITY.md +++ b/docs/TRACEABILITY.md @@ -60,7 +60,7 @@ Each arrow is a separate authority. Success at an earlier stage cannot fabricate | Release/acquisition readiness | release/provenance/acquisition contracts | release verification and evidence scripts, digest-bound revenue/transfer source documents | exact-source package/SBOM/provenance/readiness and retained-source byte-integrity tests | immutable release/deployment/customer/revenue/legal authority | Technical byte binding implemented; commercial/legal authenticity remains external | | External Claude plugin admission | ADR 0015 + issue #545 + FR-022 | `src/tool-capability/external-extension-admission.ts` local fail-closed port/ACL | external-extension suites covering mutable source, catalog mismatch, forged receipts, independent Policy / Approval, pilot ceiling, activation provenance, activation→invocation chronology, expiry/rollback, catalog drift, replay, instruction promotion, product-runtime wrappers, and secret/product/reasoning receipts | immutable `context-graph-contracts` artifact contract, AppGuardrail successor evidence, isolation/egress operation, measured pilots | Implemented on protected main as admission boundary; later shared-contract/pilot evidence remains separate | | External-extension lifecycle State / Checkpoint evidence | ADR 0015 + issue #561 | protected `src/tool-capability/external-extension-lifecycle-store.ts`, lifecycle evidence/runtime binding and private operability projection; foreign owners remain reference/digest authorities | hostile lifecycle suites covering legal edges, exact replay/conflict, expected-version/head CAS, restart/audit integrity, >128 retention, projection-tail integrity, transaction replay races, activation evidence races, Policy / Approval/effective-scope drift and storage projection validation | actual Durable Object p95/contention/storage-growth/recovery; immutable owner-issued activation authority; immutable release/deployment/pilot evidence | Implemented on protected main; ADR remains Proposed and operational evidence is not inferred from source/unit tests | -| Procedural graph advisory runtime | Proposed ADR 0017 + issue #584 | protected graph/session/screening/lifecycle surfaces plus `procedural-evaluation-authority.ts` and `procedural-evaluation-handoff.ts` | hostile schema/accessor/proxy/resource-limit tests; graph/session provenance; paired holdout and exact receipt identities; evaluation-envelope binding; P-256 signed-handoff verification; canonical signature transport; expiry-at-consumption; stable signed-claim handoff identity; `activationAuthorized: false` | live owner/Keyverse trust selection and credential custody; durable graph/rejection history and current-lifecycle/revocation authority; Policy / Approval CAS; immutable released cross-service contract; canary/rollback and production outcome evidence | Implemented on protected main as advisory-only/non-durable source; activation remains explicitly unauthorized | +| Procedural graph advisory runtime | Proposed ADR 0017 + issue #584 | protected graph/session/screening/lifecycle surfaces, `procedural-evaluation-authority.ts`, `procedural-evaluation-handoff.ts`, and State / Checkpoint bounded evaluation/rejection history | hostile schema/accessor/proxy/resource-limit tests; graph/session provenance; paired holdout and exact receipt identities; evaluation-envelope binding; P-256 signed-handoff verification; canonical signature transport; expiry-at-consumption; stable signed-claim handoff identity; history CAS/replay/digest-chain/restart/capacity evidence; `activationAuthorized: false` | live owner/Keyverse trust selection and credential custody; non-workflow current-lifecycle/revocation authority; Policy / Approval CAS; deployed history/workflow-state compatibility and p95; immutable released cross-service contract; graph publication, canary/rollback and production outcome evidence | Implemented on protected main with bounded durable evaluation/rejection history; graph activation remains explicitly unauthorized | ## 3. Live governance traceability @@ -83,7 +83,7 @@ Historical or integrated PR numbers are deliberately omitted from current owners | Acquisition coordination | issue #5 | Coordinates evidence families without promoting earlier evidence into buyer/legal/commercial authority. | | External Claude plugin admission | issue #545 | Local fail-closed Tool / Capability port only; marketplace installation, Anthropic review, isolation runtime, and shared-contract GA remain separate authorities. | | External-extension lifecycle persistence | issue #561 | Noema owns lifecycle State / Checkpoint / Recovery evidence; Policy / Approval plus AppGuardrail/quarantine/Egress/identity/model-routing authorities remain separate and are retained only as immutable references/digests. | -| Procedural graph advisory runtime | issue #584 | Noema owns bounded execution-local advisory graph/session mechanics, deterministic candidate screening, exact local evaluation-envelope binding, and verification of a separately trusted signed evaluator handoff. Released wire contracts, live signer trust/key custody, enterprise adoption, model routing, durable current lifecycle/revocation, Policy / Approval, graph-domain truth and canary/rollback evidence remain with their canonical owners. | +| Procedural graph advisory runtime | issue #584 | Noema owns bounded execution-local advisory graph/session mechanics, deterministic candidate screening, exact evaluation-envelope/authenticated handoff binding, and bounded durable evaluation/rejection history under State / Checkpoint. Released wire contracts, live signer trust/key custody, enterprise adoption, model routing, non-workflow current lifecycle/revocation, Policy / Approval, graph-domain truth and canary/rollback evidence remain with their canonical owners. | Canonical architecture/documentation is code-current by revision and is not owned by a historical documentation PR. Transient queue/green states belong to observation-scoped evidence, not timeless architecture claims. @@ -219,12 +219,15 @@ strict tenant/task/graph input → exact evaluation-receipt identities + canonical evaluation envelope → separately trusted P-256 signed evaluator handoff verification → stable signed-claim handoff identity + expiry-at-consumption +→ bounded durable evaluation/rejection history under State / Checkpoint → Policy / Approval boundary; no source-level activation grant -→ later durable graph/rejection history + current-lifecycle revocation + canary/rollback evidence +→ later live trust selection + current-lifecycle revocation + graph publication/canary/rollback evidence → immutable released-contract and production outcome evidence owned by their canonical owners ``` -Protected signed-handoff verification authenticates the supplied evaluator assertion against the public key and signer key id selected by the composition root, binds it to the exact evaluation envelope and bounded validity interval, rejects noncanonical signature transport, and re-checks expiry when process-local evidence is consumed. The stable handoff identity is derived from the signed claim semantics rather than the ECDSA signature instance. This source still does not discover or custody Keyverse credentials, establish live signer trust, persist graph history, prove that a caller-cached lifecycle snapshot is current, grant tools, approve a graph, publish a cross-language contract, or authorize activation. `context-graph-contracts` owns any released cross-service schema; `enterprise-architecture-core` owns enterprise adoption/decision records; `contextual-orchestrator` owns model discovery/routing; Keyverse owns identity/key custody; the consuming product owns graph content and outcome truth. Any future activation path must add durable current-lifecycle/revocation and Policy / Approval authorities explicitly rather than inferring them from `eligibleForApproval`, a graph/evaluation digest, a verified handoff, or a supplied `running` snapshot. +Protected signed-handoff verification authenticates the supplied evaluator assertion against the public key and signer key id selected by the composition root, binds it to the exact evaluation envelope and bounded validity interval, rejects noncanonical signature transport, and re-checks expiry when process-local evidence is consumed. The stable handoff identity is derived from the signed claim semantics rather than the ECDSA signature instance. Protected #597 then retains bounded durable evaluation/rejection history under State / Checkpoint, binding admitted graph/evaluation/authenticated signed-claim identities and minimized rejection evidence with monotonic CAS, exact replay, digest-chain integrity, duplicate-handoff refusal, restart reconstruction, and fail-closed bounded capacity. + +Neither the verified handoff nor the retained history establishes live signer trust, graph publication, Policy / Approval, or activation. Noema still does not discover or custody Keyverse credentials, prove that a caller-cached lifecycle snapshot is current, grant tools, publish a cross-language contract, or own product-domain outcome truth. `context-graph-contracts` owns any released cross-service schema; `enterprise-architecture-core` owns enterprise adoption/decision records; `contextual-orchestrator` owns model discovery/routing; Keyverse/owner composition owns identity/key custody and live signer selection; the consuming product owns graph content and outcome truth. Any future activation path must add current-lifecycle/revocation and Policy / Approval authorities explicitly rather than inferring them from `eligibleForApproval`, a graph/evaluation digest, a verified handoff, retained history, or a supplied `running` snapshot. ## 14. Update rule From 83faa9b5dd67fd3ca42ff9e8c9354e7d96663c50 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:19:12 +0900 Subject: [PATCH 09/13] docs(agent-runtime): converge procedural history gap baseline --- docs/product-technical-gap-baseline.md | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index e1ce6775a..ef7250ffa 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,11 +4,11 @@ 이 문서는 protected source, active candidate, transient workflow evidence와 foreign-owner authority를 분리한다. Open PR exact head, protected base, required workflow, review thread, release와 central dependency는 mutation·merge·release 직전에 다시 읽는다. predecessor GREEN, queued/pending/in-progress/skipped/cancelled run, 오래된 PR base snapshot과 scanner/model judgement는 다음 revision의 merge authority로 전용하지 않는다. queued는 GREEN이 아니다. -Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@0e899886b039ed27f71bdbc4540ea266b8ef9aed`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588의 canonical documentation convergence, 그리고 merged #589의 workflow-backed current-state ACL을 포함한다. +Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@61f2b372d55c87e1763bc11d3e545967fc0a9cf5`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588의 canonical documentation convergence, merged #589의 workflow-backed current-state ACL, 그리고 #590–#597의 procedural evidence/provenance/authenticated-handoff/State / Checkpoint history source를 포함한다. Moving central control-plane snapshot은 central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. -Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring integration #587, canonical documentation integration #588, workflow-backed current-state integration #589가 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. +Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring integration #587, canonical documentation integration #588, workflow-backed current-state integration #589, 그리고 procedural evidence/provenance/history integrations #590–#597이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. 이 baseline과 executable documentation-authority test는 active documentation-authority lane 하나만 write한다. mutation 직전 open PR/Issue/branch를 fresh-read해 writer를 결정하며 merged/closed historical PR 번호를 active sole writer로 고정하지 않는다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다. @@ -18,7 +18,7 @@ Noema Core Domain은 Agent Runtime과 Workflow / Task Execution이다. Tool / Ca `contextual-orchestrator`는 provider/model discovery, routing, retry/failover, test-time compute와 provider credential을 소유한다. Noema는 released gateway contract와 canonical `orchestrator/free` alias를 소비하며 direct provider SDK, provider key, provider/model/group fallback policy를 소유하지 않는다. `.github`는 organization reusable workflow/control-plane source다. Keyverse는 identity backend다. `quarantine-sandbox-runtime`, Wardnet, EgressWeave, AppGuardrail은 각자의 isolation/security/outbound/scanning truth를 소유한다. Noema는 그 owner evidence를 reference/pin으로 소비할 뿐 foreign implementation이나 domain table을 복제하지 않는다. Cross-service SQL과 mutable sibling PR dependency는 금지한다. -Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics, deterministic direct-child screening, caller-supplied fresh authenticated lifecycle snapshot에 대한 running-only projection을 구현했다. Protected #589는 workflow-backed execution에 한해 기존 execution-scoped Workflow / Task Execution Durable Object를 매 guidance decision 전에 다시 읽고, locally admitted session과 re-admitted plan의 execution identity를 durable lookup 전에 검증하는 current-state ACL을 추가했다. 이 protected ACL은 두 번째 lifecycle store나 mutation/approval authority가 아니며, non-workflow lifecycle freshness, released wire contracts, authenticated evaluator receipts, durable graph/rejection history, Policy / Approval CAS, deployed Durable Object p95/recovery, canary/rollback과 product-outcome authority는 여전히 별도다. +Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics, deterministic direct-child screening, caller-supplied fresh authenticated lifecycle snapshot에 대한 running-only projection을 구현했다. Protected #589는 workflow-backed execution에 한해 기존 execution-scoped Workflow / Task Execution Durable Object를 매 guidance decision 전에 다시 읽고, locally admitted session과 re-admitted plan의 execution identity를 durable lookup 전에 검증하는 current-state ACL을 추가했다. Protected #591–#596은 candidate-decision provenance, exact paired evaluation-receipt identity, evaluation-envelope binding, separately authenticated signed evaluator handoff와 rejection/disposition binding을 추가했고, protected #597은 기존 State / Checkpoint 경계 아래 bounded durable evaluation/rejection history를 추가했다. 이 history는 monotonic CAS, exact replay, digest-chain integrity, duplicate-handoff 거부, restart reconstruction과 fail-closed bounded capacity를 갖지만 graph publication이나 Policy / Approval authority는 아니다. Non-workflow lifecycle freshness, released wire contracts, live Keyverse/owner signer trust selection, Policy / Approval CAS, deployed Durable Object compatibility/p95/recovery, graph publication, canary/rollback과 product-outcome authority는 여전히 별도다. ## Integrated exact-claim evidence — issue #555 / merged PR #556 @@ -62,19 +62,21 @@ This source chain does not complete #561. A genuinely new `active` transition re Operational acceptance still requires the actual deployed SQLite Durable Object: realistic current-read and contended-append denominators with evaluator-computed p95 ≤20 ms where synchronous, exactly-one-winner CAS contention, >128-event audit/restart continuity, malformed/truncated state rejection, exact-object storage growth, PITR or equivalent recovery rehearsal, and deployment/release provenance authenticating the producer. Local/workerd timing, namespace storage charts, synthetic evidence and self-asserted JSON do not satisfy that boundary. -## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589 +## Protected procedural graph advisory source — issue #584 / merged #585 + #586 + #589 + #597 Protected source includes the library-only Agent Runtime procedural graph aggregate, its execution-lifecycle projection, and the workflow-backed current-state ACL. The graph boundary uses strict descriptor-safe input, immutable tenant/task/graph snapshots, canonical content/structure identities, module-local graph/session admission, canonical execution identity, cycle-safe bounded directed context and explicit unknown/budget abstention. Candidate screening accepts only an admitted direct child under exact paired held-out evidence, rejects training/holdout leakage, incomplete/duplicate cases, invalid scores, candidate safety violations and measured mean regression, and retains `activationAuthorized: false` for every decision. `guideProceduralExecution()` projects context only from a locally admitted session when the caller supplies a fresh authenticated same-execution `running` lifecycle snapshot; accepted, cancellation-requested and terminal states suppress guidance. Protected #589 adds a read-only workflow-backed ACL that verifies session/plan execution identity before durable lookup and re-reads the existing Workflow / Task Execution owner before every decision so current cancellation, terminal work and pre-start evidence suppress guidance. Neither adapter becomes a second lifecycle store or approval/activation authority. -Noema does not absorb downstream owners to complete this lane. Released procedural graph wire/schema identity belongs to `context-graph-contracts`; enterprise adoption and decision records to `enterprise-architecture-core`; model discovery/routing to `contextual-orchestrator`; credentials to Keyverse; graph content, evaluation design and production outcome truth to the consuming product. Protected graph/session identity, `eligibleForApproval`, or a caller-supplied lifecycle snapshot are local deterministic/runtime evidence, not signatures, durable state, Policy / Approval or activation authority. This source adds no provider SDK/key, persistent graph store, HTTP route, automatic model refiner, tool authority or activation path. +Protected #591–#596 additionally bind process-local candidate-decision provenance, exact paired evaluation-receipt identities, evaluator/version/policy plus dataset/rubric/model/tool/protocol/validation-plan digests, separately authenticated P-256 signed evaluator handoff, canonical signature transport, bounded validity and rejection/disposition semantics. The verifier accepts a public key and signer identity chosen by the composition root; it does not discover, store, rotate or administer private signer keys. Protected #597 adds bounded durable evaluation/rejection history under the existing State / Checkpoint boundary, retaining payload-minimized graph/evaluation/authenticated signed-claim identities with monotonic CAS, exact authenticated replay, digest-chain verification, durable rejection projection, duplicate-handoff refusal, restart reconstruction and fail-closed 128-event capacity without silent eviction. This retained history is evidence state, not graph publication, Policy / Approval or activation authority. -Source integration is complete for #585/#586/#589. ADR 0017 remains `Proposed` until immutable released contracts, authenticated evaluation receipts, durable graph/rejection history plus current-lifecycle/revocation authority, Policy / Approval CAS, deployed Workflow / Task Execution compatibility and synchronous buyer-path p95 evidence, canary/rollback evidence and product-owner production outcome evidence exist. Canonical documentation must describe that separation without treating historical PR numbers as moving current authority. +Noema does not absorb downstream owners to complete this lane. Released procedural graph wire/schema identity belongs to `context-graph-contracts`; enterprise adoption and decision records to `enterprise-architecture-core`; model discovery/routing to `contextual-orchestrator`; credentials and live signer trust selection to Keyverse/owner composition; graph content, evaluation design and production outcome truth to the consuming product. Protected graph/session identity, `eligibleForApproval`, authenticated handoff or retained history are Noema evidence, not tool, lifecycle, Policy / Approval, publication or activation authority. This source adds no provider SDK/key, second Workflow / Task or lifecycle store, product-domain graph store, HTTP activation route or automatic model refiner. + +Source integration is complete for #585/#586/#589 and the #591–#597 evidence/history slices. ADR 0017 remains `Proposed` until immutable released contracts, live Keyverse/owner trust selection, non-workflow current-lifecycle/revocation authority, Policy / Approval CAS tied to exact graph/evaluation/authenticated signed-claim/history identities, deployed Workflow / Task and history-store compatibility plus synchronous buyer-path p95 evidence, graph publication, canary/rollback evidence and product-owner production outcome evidence exist. Canonical documentation must describe that separation without treating historical PR numbers as moving current authority. ## Protected workflow-backed procedural current-state ACL — merged PR #589 Merged #589 adds a read-only Agent Runtime ACL over the existing execution-scoped Workflow / Task Execution Durable Object. Every workflow-backed guidance decision re-admits the plan, verifies that the locally admitted procedural session has the same canonical execution identity before any Durable Object lookup, then reads current workflow state through the existing private `read` command. Exact execution/plan identity, complete unique task identities, allowed task states, cancellation identity and transition sequence are validated before a conservative lifecycle projection reaches the protected running-only procedural gate. Current cancellation, terminal work and pre-start evidence suppress guidance. Cross-execution mismatch is rejected without reading the foreign execution object. -This protected ACL does not create a second lifecycle database, mutate Workflow / Task Execution state, grant retry/tool/Policy / Approval authority, or turn graph/evaluation data into activation truth. Source integration also does not prove deployed Durable Object compatibility, restart/failure behavior, synchronous p95, non-workflow lifecycle freshness, immutable release, graph persistence/promotion, canary/rollback or product outcome. Those remain later acceptance classes under issue #584. +This protected ACL does not create a second lifecycle database, mutate Workflow / Task Execution state, grant retry/tool/Policy / Approval authority, or turn graph/evaluation data into activation truth. Source integration also does not prove deployed Durable Object compatibility, restart/failure behavior, synchronous p95, non-workflow lifecycle freshness, immutable release, graph publication/promotion, canary/rollback or product outcome. Those remain later acceptance classes under issue #584. ## Evidence and merge rules @@ -92,7 +94,7 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge | --- | --- | --- | --- | --- | --- | --- | | P0 | Exact-claim evidence supply chain | Tool/research claim이 producer evidence 없이 reviewer authority가 될 위험 | protected #556 + release/consumer lanes | Source integrated; producer/release/consumer open | protected source + execution/research producer + immutable Noema release + released central consumer corpus RED→GREEN | release/producer evidence를 별도 lane에서 완성 | | P0 | External extension lifecycle evidence | third-party extension의 stale/revoked authority, process-local lifecycle, forged operability 또는 unbound storage/recovery evidence가 runtime truth로 오인될 위험 | protected #574/#577/#578/#579/#580/#581/#582 + issue #561 | Lifecycle/SQLite DO source integrated; production activation adapter + deployed operability/recovery/release evidence open | immutable source + Noema Policy/Approval + immutable foreign-owner refs + append-only lifecycle/CAS/restart + exact deployed p95/contention/storage/recovery + deployment/release provenance | fail-closed `active`를 유지하고 immutable owner-issued refs가 준비된 뒤 production adapter를 연결한 후 actual deployed #561 acceptance를 실행 | -| P0 | Procedural graph advisory activation boundary | deterministic local graph/session/screening 결과나 caller-cached lifecycle snapshot이 signed contract, durable current-state approval 또는 product authority처럼 소비될 위험 | protected #585/#586/#589 + issue #584 | Core/pure adapter/workflow-backed current-state ACL protected; activation intentionally unavailable | protected exact source + released `context-graph-contracts` contract + authenticated paired evaluation receipts + explicit Policy/Approval + durable graph/rejection history/promotion CAS + deployed current-state evidence + canary/rollback + product-owner outcome evidence | post-merge documentation authority를 수렴한 뒤 authenticated evaluation + durable graph/rejection history + Policy/Approval CAS를 owner-approved successor로 진행 | +| P0 | Procedural graph advisory activation boundary | deterministic graph/session/screening, authenticated evaluation or retained history가 durable current-state approval 또는 product authority처럼 소비될 위험 | protected #585/#586/#589/#591–#597 + issue #584 | Advisory/runtime/evaluation-auth/history source integrated; activation intentionally unavailable | protected exact source + released `context-graph-contracts` contract + live owner/Keyverse signer trust + explicit Policy / Approval + exact graph/evaluation/authenticated signed-claim/history CAS promotion/revocation + deployed current-state/history evidence + canary/rollback + product-owner outcome evidence | documentation convergence 뒤 live trust-selection owner path를 검증하고 Noema Policy / Approval CAS promotion/revocation을 별도 successor로 진행 | | P0 | Protected-main governance closure | required Security workflow만으로 PR/review/history/deletion/bypass 통제를 증명했다고 오인할 위험 | issue #27 | Open; external control evidence absent | fresh live ruleset + required PR/review/conversation/history/deletion controls + independent bypass/break-glass evidence + protected-source governance receipt | source가 만들 수 없는 organization/admin control은 issue #27에서 독립 검증 | | P0 | Strict orchestrator/free consumer release | source 통합만으로 immutable consumer activation을 증명할 수 없음 | merged #535 + release lane | Source integrated; release/consumer open | version/tag/package/SBOM/provenance/reproducibility/rollback + released consumer | release-ready protected head에서만 publication | | P0 | Patch-validator operational publication | source/image CI success만으로 reusable immutable runtime을 증명할 수 없음 | issue #66 | Open; publication evidence absent | protected execution + immutable image/signature/SBOM/provenance/reproducibility/rollback | protected-main operational image receipt 뒤 immutable publication/signing/attestation/activation을 별도 증거로 완성 | @@ -103,4 +105,4 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge ## Release boundary -Dated release observation for this repair (2026-09-10 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. +Dated release observation for this repair (2026-09-11 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. \ No newline at end of file From 67468a218da9cfddb7a513e3585ed9205d6dda6a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:23:14 +0900 Subject: [PATCH 10/13] docs(agent-runtime): correct procedural evidence lineage --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index ef7250ffa..2fef3d3ca 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,11 +4,11 @@ 이 문서는 protected source, active candidate, transient workflow evidence와 foreign-owner authority를 분리한다. Open PR exact head, protected base, required workflow, review thread, release와 central dependency는 mutation·merge·release 직전에 다시 읽는다. predecessor GREEN, queued/pending/in-progress/skipped/cancelled run, 오래된 PR base snapshot과 scanner/model judgement는 다음 revision의 merge authority로 전용하지 않는다. queued는 GREEN이 아니다. -Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@61f2b372d55c87e1763bc11d3e545967fc0a9cf5`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588의 canonical documentation convergence, merged #589의 workflow-backed current-state ACL, 그리고 #590–#597의 procedural evidence/provenance/authenticated-handoff/State / Checkpoint history source를 포함한다. +Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@61f2b372d55c87e1763bc11d3e545967fc0a9cf5`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588과 #590의 canonical documentation convergence, merged #589의 workflow-backed current-state ACL, 그리고 #591–#597의 procedural decision/evidence/provenance/authenticated-handoff/State / Checkpoint history source를 포함한다. Moving central control-plane snapshot은 central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. -Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring integration #587, canonical documentation integration #588, workflow-backed current-state integration #589, 그리고 procedural evidence/provenance/history integrations #590–#597이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. +Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring integration #587, canonical documentation integrations #588/#590, workflow-backed current-state integration #589, 그리고 procedural decision/evidence/provenance/history integrations #591–#597이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. 이 baseline과 executable documentation-authority test는 active documentation-authority lane 하나만 write한다. mutation 직전 open PR/Issue/branch를 fresh-read해 writer를 결정하며 merged/closed historical PR 번호를 active sole writer로 고정하지 않는다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다. From d540c24260a5035cf4ccfe231a6eb8bdffb49396 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:25:09 +0900 Subject: [PATCH 11/13] docs(agent-runtime): distinguish source and doctoring lineage --- docs/product-technical-gap-baseline.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index 2fef3d3ca..b19d842d3 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -4,11 +4,11 @@ 이 문서는 protected source, active candidate, transient workflow evidence와 foreign-owner authority를 분리한다. Open PR exact head, protected base, required workflow, review thread, release와 central dependency는 mutation·merge·release 직전에 다시 읽는다. predecessor GREEN, queued/pending/in-progress/skipped/cancelled run, 오래된 PR base snapshot과 scanner/model judgement는 다음 revision의 merge authority로 전용하지 않는다. queued는 GREEN이 아니다. -Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@61f2b372d55c87e1763bc11d3e545967fc0a9cf5`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588과 #590의 canonical documentation convergence, merged #589의 workflow-backed current-state ACL, 그리고 #591–#597의 procedural decision/evidence/provenance/authenticated-handoff/State / Checkpoint history source를 포함한다. +Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@61f2b372d55c87e1763bc11d3e545967fc0a9cf5`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588/#590/#595의 documentation convergence, merged #589의 workflow-backed current-state ACL, #591/#592/#593/#594/#596의 procedural decision/evaluation/authenticated-handoff source, 그리고 #597의 State / Checkpoint history source를 포함한다. Moving central control-plane snapshot은 central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. -Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring integration #587, canonical documentation integrations #588/#590, workflow-backed current-state integration #589, 그리고 procedural decision/evidence/provenance/history integrations #591–#597이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. +Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring/canonical-documentation integrations #587/#588/#590/#595, workflow-backed current-state integration #589, procedural decision/evaluation/authentication integrations #591/#592/#593/#594/#596, State / Checkpoint history integration #597이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. 이 baseline과 executable documentation-authority test는 active documentation-authority lane 하나만 write한다. mutation 직전 open PR/Issue/branch를 fresh-read해 writer를 결정하며 merged/closed historical PR 번호를 active sole writer로 고정하지 않는다. 다른 feature lane의 과거 baseline blob은 ordinary/non-force semantic convergence 때 current authority로 승계하지 않는다. @@ -18,7 +18,7 @@ Noema Core Domain은 Agent Runtime과 Workflow / Task Execution이다. Tool / Ca `contextual-orchestrator`는 provider/model discovery, routing, retry/failover, test-time compute와 provider credential을 소유한다. Noema는 released gateway contract와 canonical `orchestrator/free` alias를 소비하며 direct provider SDK, provider key, provider/model/group fallback policy를 소유하지 않는다. `.github`는 organization reusable workflow/control-plane source다. Keyverse는 identity backend다. `quarantine-sandbox-runtime`, Wardnet, EgressWeave, AppGuardrail은 각자의 isolation/security/outbound/scanning truth를 소유한다. Noema는 그 owner evidence를 reference/pin으로 소비할 뿐 foreign implementation이나 domain table을 복제하지 않는다. Cross-service SQL과 mutable sibling PR dependency는 금지한다. -Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics, deterministic direct-child screening, caller-supplied fresh authenticated lifecycle snapshot에 대한 running-only projection을 구현했다. Protected #589는 workflow-backed execution에 한해 기존 execution-scoped Workflow / Task Execution Durable Object를 매 guidance decision 전에 다시 읽고, locally admitted session과 re-admitted plan의 execution identity를 durable lookup 전에 검증하는 current-state ACL을 추가했다. Protected #591–#596은 candidate-decision provenance, exact paired evaluation-receipt identity, evaluation-envelope binding, separately authenticated signed evaluator handoff와 rejection/disposition binding을 추가했고, protected #597은 기존 State / Checkpoint 경계 아래 bounded durable evaluation/rejection history를 추가했다. 이 history는 monotonic CAS, exact replay, digest-chain integrity, duplicate-handoff 거부, restart reconstruction과 fail-closed bounded capacity를 갖지만 graph publication이나 Policy / Approval authority는 아니다. Non-workflow lifecycle freshness, released wire contracts, live Keyverse/owner signer trust selection, Policy / Approval CAS, deployed Durable Object compatibility/p95/recovery, graph publication, canary/rollback과 product-outcome authority는 여전히 별도다. +Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics, deterministic direct-child screening, caller-supplied fresh authenticated lifecycle snapshot에 대한 running-only projection을 구현했다. Protected #589는 workflow-backed execution에 한해 기존 execution-scoped Workflow / Task Execution Durable Object를 매 guidance decision 전에 다시 읽고, locally admitted session과 re-admitted plan의 execution identity를 durable lookup 전에 검증하는 current-state ACL을 추가했다. Protected #591/#592/#593/#594/#596은 candidate-decision provenance, exact paired evaluation-receipt identity, evaluation-envelope binding, separately authenticated signed evaluator handoff와 rejection/disposition binding을 구현했고 #595는 그 signed-handoff 상태를 canonical TRACEABILITY에 수렴시킨 documentation integration이다. Protected #597은 기존 State / Checkpoint 경계 아래 bounded durable evaluation/rejection history를 추가했다. 이 history는 monotonic CAS, exact replay, digest-chain integrity, duplicate-handoff 거부, restart reconstruction과 fail-closed bounded capacity를 갖지만 graph publication이나 Policy / Approval authority는 아니다. Non-workflow lifecycle freshness, released wire contracts, live Keyverse/owner signer trust selection, Policy / Approval CAS, deployed Durable Object compatibility/p95/recovery, graph publication, canary/rollback과 product-outcome authority는 여전히 별도다. ## Integrated exact-claim evidence — issue #555 / merged PR #556 @@ -66,11 +66,11 @@ Operational acceptance still requires the actual deployed SQLite Durable Object: Protected source includes the library-only Agent Runtime procedural graph aggregate, its execution-lifecycle projection, and the workflow-backed current-state ACL. The graph boundary uses strict descriptor-safe input, immutable tenant/task/graph snapshots, canonical content/structure identities, module-local graph/session admission, canonical execution identity, cycle-safe bounded directed context and explicit unknown/budget abstention. Candidate screening accepts only an admitted direct child under exact paired held-out evidence, rejects training/holdout leakage, incomplete/duplicate cases, invalid scores, candidate safety violations and measured mean regression, and retains `activationAuthorized: false` for every decision. `guideProceduralExecution()` projects context only from a locally admitted session when the caller supplies a fresh authenticated same-execution `running` lifecycle snapshot; accepted, cancellation-requested and terminal states suppress guidance. Protected #589 adds a read-only workflow-backed ACL that verifies session/plan execution identity before durable lookup and re-reads the existing Workflow / Task Execution owner before every decision so current cancellation, terminal work and pre-start evidence suppress guidance. Neither adapter becomes a second lifecycle store or approval/activation authority. -Protected #591–#596 additionally bind process-local candidate-decision provenance, exact paired evaluation-receipt identities, evaluator/version/policy plus dataset/rubric/model/tool/protocol/validation-plan digests, separately authenticated P-256 signed evaluator handoff, canonical signature transport, bounded validity and rejection/disposition semantics. The verifier accepts a public key and signer identity chosen by the composition root; it does not discover, store, rotate or administer private signer keys. Protected #597 adds bounded durable evaluation/rejection history under the existing State / Checkpoint boundary, retaining payload-minimized graph/evaluation/authenticated signed-claim identities with monotonic CAS, exact authenticated replay, digest-chain verification, durable rejection projection, duplicate-handoff refusal, restart reconstruction and fail-closed 128-event capacity without silent eviction. This retained history is evidence state, not graph publication, Policy / Approval or activation authority. +Protected #591/#592/#593/#594/#596 additionally bind process-local candidate-decision provenance, exact paired evaluation-receipt identities, evaluator/version/policy plus dataset/rubric/model/tool/protocol/validation-plan digests, separately authenticated P-256 signed evaluator handoff, canonical signature transport, bounded validity and rejection/disposition semantics; #595 is the documentation convergence for the signed-handoff classification. The verifier accepts a public key and signer identity chosen by the composition root; it does not discover, store, rotate or administer private signer keys. Protected #597 adds bounded durable evaluation/rejection history under the existing State / Checkpoint boundary, retaining payload-minimized graph/evaluation/authenticated signed-claim identities with monotonic CAS, exact authenticated replay, digest-chain verification, durable rejection projection, duplicate-handoff refusal, restart reconstruction and fail-closed 128-event capacity without silent eviction. This retained history is evidence state, not graph publication, Policy / Approval or activation authority. Noema does not absorb downstream owners to complete this lane. Released procedural graph wire/schema identity belongs to `context-graph-contracts`; enterprise adoption and decision records to `enterprise-architecture-core`; model discovery/routing to `contextual-orchestrator`; credentials and live signer trust selection to Keyverse/owner composition; graph content, evaluation design and production outcome truth to the consuming product. Protected graph/session identity, `eligibleForApproval`, authenticated handoff or retained history are Noema evidence, not tool, lifecycle, Policy / Approval, publication or activation authority. This source adds no provider SDK/key, second Workflow / Task or lifecycle store, product-domain graph store, HTTP activation route or automatic model refiner. -Source integration is complete for #585/#586/#589 and the #591–#597 evidence/history slices. ADR 0017 remains `Proposed` until immutable released contracts, live Keyverse/owner trust selection, non-workflow current-lifecycle/revocation authority, Policy / Approval CAS tied to exact graph/evaluation/authenticated signed-claim/history identities, deployed Workflow / Task and history-store compatibility plus synchronous buyer-path p95 evidence, graph publication, canary/rollback evidence and product-owner production outcome evidence exist. Canonical documentation must describe that separation without treating historical PR numbers as moving current authority. +Source integration is complete for #585/#586/#589, #591/#592/#593/#594/#596 and #597; #595 is documentation-only convergence. ADR 0017 remains `Proposed` until immutable released contracts, live Keyverse/owner trust selection, non-workflow current-lifecycle/revocation authority, Policy / Approval CAS tied to exact graph/evaluation/authenticated signed-claim/history identities, deployed Workflow / Task and history-store compatibility plus synchronous buyer-path p95 evidence, graph publication, canary/rollback evidence and product-owner production outcome evidence exist. Canonical documentation must describe that separation without treating historical PR numbers as moving current authority. ## Protected workflow-backed procedural current-state ACL — merged PR #589 @@ -94,7 +94,7 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge | --- | --- | --- | --- | --- | --- | --- | | P0 | Exact-claim evidence supply chain | Tool/research claim이 producer evidence 없이 reviewer authority가 될 위험 | protected #556 + release/consumer lanes | Source integrated; producer/release/consumer open | protected source + execution/research producer + immutable Noema release + released central consumer corpus RED→GREEN | release/producer evidence를 별도 lane에서 완성 | | P0 | External extension lifecycle evidence | third-party extension의 stale/revoked authority, process-local lifecycle, forged operability 또는 unbound storage/recovery evidence가 runtime truth로 오인될 위험 | protected #574/#577/#578/#579/#580/#581/#582 + issue #561 | Lifecycle/SQLite DO source integrated; production activation adapter + deployed operability/recovery/release evidence open | immutable source + Noema Policy/Approval + immutable foreign-owner refs + append-only lifecycle/CAS/restart + exact deployed p95/contention/storage/recovery + deployment/release provenance | fail-closed `active`를 유지하고 immutable owner-issued refs가 준비된 뒤 production adapter를 연결한 후 actual deployed #561 acceptance를 실행 | -| P0 | Procedural graph advisory activation boundary | deterministic graph/session/screening, authenticated evaluation or retained history가 durable current-state approval 또는 product authority처럼 소비될 위험 | protected #585/#586/#589/#591–#597 + issue #584 | Advisory/runtime/evaluation-auth/history source integrated; activation intentionally unavailable | protected exact source + released `context-graph-contracts` contract + live owner/Keyverse signer trust + explicit Policy / Approval + exact graph/evaluation/authenticated signed-claim/history CAS promotion/revocation + deployed current-state/history evidence + canary/rollback + product-owner outcome evidence | documentation convergence 뒤 live trust-selection owner path를 검증하고 Noema Policy / Approval CAS promotion/revocation을 별도 successor로 진행 | +| P0 | Procedural graph advisory activation boundary | deterministic graph/session/screening, authenticated evaluation or retained history가 durable current-state approval 또는 product authority처럼 소비될 위험 | protected #585/#586/#589/#591/#592/#593/#594/#596/#597 + issue #584 | Advisory/runtime/evaluation-auth/history source integrated; activation intentionally unavailable | protected exact source + released `context-graph-contracts` contract + live owner/Keyverse signer trust + explicit Policy / Approval + exact graph/evaluation/authenticated signed-claim/history CAS promotion/revocation + deployed current-state/history evidence + canary/rollback + product-owner outcome evidence | documentation convergence 뒤 live trust-selection owner path를 검증하고 Noema Policy / Approval CAS promotion/revocation을 별도 successor로 진행 | | P0 | Protected-main governance closure | required Security workflow만으로 PR/review/history/deletion/bypass 통제를 증명했다고 오인할 위험 | issue #27 | Open; external control evidence absent | fresh live ruleset + required PR/review/conversation/history/deletion controls + independent bypass/break-glass evidence + protected-source governance receipt | source가 만들 수 없는 organization/admin control은 issue #27에서 독립 검증 | | P0 | Strict orchestrator/free consumer release | source 통합만으로 immutable consumer activation을 증명할 수 없음 | merged #535 + release lane | Source integrated; release/consumer open | version/tag/package/SBOM/provenance/reproducibility/rollback + released consumer | release-ready protected head에서만 publication | | P0 | Patch-validator operational publication | source/image CI success만으로 reusable immutable runtime을 증명할 수 없음 | issue #66 | Open; publication evidence absent | protected execution + immutable image/signature/SBOM/provenance/reproducibility/rollback | protected-main operational image receipt 뒤 immutable publication/signing/attestation/activation을 별도 증거로 완성 | From d5ac9d7617247b2d195fadddeaca1d5bc9e14bf9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:32:25 +0900 Subject: [PATCH 12/13] test(docs): reject stale moving central snapshot --- test/documentation-current-trust-authority.test.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/test/documentation-current-trust-authority.test.ts b/test/documentation-current-trust-authority.test.ts index f76f5d913..c61e03725 100644 --- a/test/documentation-current-trust-authority.test.ts +++ b/test/documentation-current-trust-authority.test.ts @@ -12,7 +12,10 @@ describe("current protected trust authority documentation", () => { /Dated protected observation for this repair는 `main@[0-9a-f]{40}`/, ); expect(baseline).toContain("merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`"); - expect(baseline).toContain("central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`"); + expect(baseline).toMatch( + /Dated central control-plane observation for this repair는 central `\.github\/main@[0-9a-f]{40}`/, + ); + expect(baseline).not.toContain("Moving central control-plane snapshot은 central"); expect(baseline).toContain("`ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`"); expect(baseline).toContain("Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며"); expect(baseline).not.toMatch( From 2c4821fe00a9691066a86311b141a46fe8ea68e7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 11 Sep 2026 00:35:08 +0900 Subject: [PATCH 13/13] docs(agent-runtime): date central control-plane observation --- docs/product-technical-gap-baseline.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md index b19d842d3..415730243 100644 --- a/docs/product-technical-gap-baseline.md +++ b/docs/product-technical-gap-baseline.md @@ -6,7 +6,7 @@ Current protected source는 mutation·merge·release 시점에 live protected `main`을 다시 조회해 결정한다. 이 문서 안의 exact source SHA는 dated observation 또는 protected history일 뿐 future merge 뒤 evergreen current authority로 사용하지 않는다. Dated protected observation for this repair는 `main@61f2b372d55c87e1763bc11d3e545967fc0a9cf5`이며, 이 revision은 merged PR #582 exact `0f20a4dc78e423fd5df49e137a4eb286c7075ea4`의 exact stream-scoped SQLite storage observation primitive, merged #583의 live-authority/ADR-index repair, protected procedural graph source #585/#586, merged #587의 source-vs-rollout doctoring repair, merged #588/#590/#595의 documentation convergence, merged #589의 workflow-backed current-state ACL, #591/#592/#593/#594/#596의 procedural decision/evaluation/authenticated-handoff source, 그리고 #597의 State / Checkpoint history source를 포함한다. -Moving central control-plane snapshot은 central `.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4db`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. +Dated central control-plane observation for this repair는 central `.github/main@cb0872c9a20d5584703dffacca65c096fc034c6c`다. Noema runtime의 reviewed immutable central consumer pin은 `c9052e607e5f3cc76e73207e7786b21500721b79`이고 runtime authority 표현은 `ALLOWED_WORKFLOW_SHA = c9052e607e5f3cc76e73207e7786b21500721b79`다. Moving foreign head와 reviewed immutable pin을 같은 권위로 취급하지 않으며 central moving head가 전진했다고 consumer pin을 자동 승격하지 않는다. Protected history에는 merged PR #535 exact `82b20b293f0a5f0ac0e69857c1b61dddfe478491`, merged PR #540 exact `05bc2d47c3899ebe17538070f9a30172f90307ac`, merged PR #542 exact `ca839298fcaeec409091dc909789b6f87eb67fdc`, merged PR #547 exact `30b7e7e5cdab8de65715834a16f994b2047eafa6`, merged PR #550 exact `f2ec2dc6709814070cc3e3d6932ce280aee966db`, merged PR #553 exact `3bd9f543e97ce856f78b1c608141436298ce9e74`, merged PR #558 exact `2f91bf8641212ecae435b5fbcc9084cc0acd6295`, merged PR #556 exact `860714cba46dba06260a5dce09d0e9152fcb0a8c`, merged PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`와 이후 external-extension lifecycle/operability source integrations #574, #577, #578, #579, #580, #581, #582, documentation-authority integration #583, procedural graph source integrations #585/#586, doctoring/canonical-documentation integrations #587/#588/#590/#595, workflow-backed current-state integration #589, procedural decision/evaluation/authentication integrations #591/#592/#593/#594/#596, State / Checkpoint history integration #597이 포함돼 있다. 이 식별자는 역사 증거이지 open-candidate authority가 아니다. @@ -105,4 +105,4 @@ PR 0은 useful work를 닫아 제조하지 않는다. Open lane은 normal merge ## Release boundary -Dated release observation for this repair (2026-09-11 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다. \ No newline at end of file +Dated release observation for this repair (2026-09-11 KST)는 GitHub Releases 0건이다. 이 관측은 이후 publication을 영구 부정하는 authority가 아니며 release 판단 직전에 live collection을 다시 읽는다. GitHub release collection에 immutable Noema release가 실제 존재하기 전 version/tag/package/SBOM/provenance/reproducibility/rollback completion을 주장하지 않는다. Release-ready exact protected head에서만 publication하고, consumer는 released/versioned contract만 bump한다.