docs(policy-approval): classify protected procedural publication preflight

ARCHITECTURE.md

@@ -98,7 +98,9 @@ Protected source also binds paired evaluation receipts and evaluator/profile con
 
 Protected #601 adds a separate Noema Policy / Approval CAS ledger. It consumes only a repository-admitted current State / Checkpoint snapshot plus an independently supplied exact policy decision and binds the graph, evaluation-history position, evaluator handoff and expected approval version into an append-only digest chain. `approve_for_pilot` requires the latest evaluation to remain `eligibleForApproval` with `validation_non_regression`; explicit `revoke` may bind a newer authenticated regression history, but only from an already-approved prior state. Exact decision replay is idempotent, stale writers fail the monotonic approval-version CAS, and every retained event/snapshot remains `activationAuthorized:false`. This is point-in-time approval evidence, not graph publication or activation authority.
 
-Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials and live signer trust selection to Keyverse/owner composition, and graph content/evaluation outcome truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration does not establish live trust selection, non-workflow current-lifecycle revocation, deployed Durable Object behavior/performance, fresh publication-time State / Checkpoint plus Policy / Approval reconciliation, graph publication, canary/rollback evidence, production activation, or organization-wide self-evolution.
+Protected #603 adds a Noema Policy / Approval **publication preflight** over those existing owners. `src/policy-approval/procedural-publication-preflight.ts` performs a stable double-read of the admitted State / Checkpoint history and Policy / Approval snapshots, requires unchanged history/approval positions across the read window, rejects current revocation, and binds the exact graph, evaluation history, evaluator handoff, signer, and approval identities before it can emit a process-local admitted receipt. The receipt is deliberately `publicationAuthorized:false` and `activationAuthorized:false`: it proves a point-in-time reconciliation only and is not a graph publisher, lifecycle authority, Keyverse trust selector, or activation capability.
+
+Cross-product ownership remains outside this protected advisory boundary: released wire contracts belong to `context-graph-contracts`, enterprise adoption/decision records to `enterprise-architecture-core`, model routing to `contextual-orchestrator`, credentials and live signer trust selection to Keyverse/owner composition, and graph content/evaluation outcome truth to the owning product. Mutable sibling PR heads are not consumed. ADR 0017 remains `Proposed`; protected source integration does not establish live trust selection, non-workflow current-lifecycle revocation, deployed Durable Object behavior/performance, an actual graph-publication transaction consuming the protected #603 publication preflight, canary/rollback evidence, production activation, or organization-wide self-evolution.
 
 ## 5. Evidence and authority separation
 
@@ -150,6 +152,8 @@ Procedural graph/session and candidate-decision authority remain process-local i
 
 Protected #601 records only exact Noema Policy / Approval decision state. Its retained event chain is keyed to the admitted graph lineage and binds current State / Checkpoint history identity, authenticated evaluator handoff identity and expected approval version. It does not own Keyverse keys, product-domain truth, graph publication, tool invocation, provider routing or activation. Because State / Checkpoint may advance after an approval transaction, publication/activation must freshly read and compare both current authorities rather than treating a prior CAS success as indefinitely current.
 
+Protected #603 is the corresponding point-in-time publication preflight read boundary. It fresh-reads both owner snapshots twice, rejects a moving history or approval head, rejects an already-revoked current approval, and returns only a locally admitted reconciliation receipt whose `publicationAuthorized:false` and `activationAuthorized:false` remain explicit. A future publisher must still consume that exact receipt together with its separately owned released graph contract, current lifecycle/revocation evidence, and live owner/Keyverse trust; #603 does not persist or transfer any of those authorities.
+
 Protected #589 separately reuses the existing durable Workflow / Task Execution state only as current task/cancellation evidence for workflow-backed advisory gating. It does not create another lifecycle store and does not turn Workflow / Task Execution into procedural-history authority. This separation keeps State / Checkpoint evidence retention, Workflow / Task current execution truth, Policy / Approval, and product-domain ownership distinct.
 
 ## 9. Standalone and modular MSA contract
@@ -169,7 +173,7 @@ Protected #589 separately reuses the existing durable Workflow / Task Execution
 | OIDC/GitHub App | issuer/audience/repository/workflow-ref, immutable workflow-source SHA when configured, malformed token/JWKS, replay, redirect/egress, secret non-disclosure regressions |
 | Durable Objects | cross-instance semantics, delayed/retried alarm, current-state reschedule, malformed backend/storage-failure tests |
 | External-extension lifecycle | legal-edge validation; restart/replay/CAS races; exact Policy / Approval and foreign-owner reference binding; corruption/truncation/cross-stream rejection; >128-transition auditability; O(1) verified current projection; full audit/recovery rehearsal; actual Durable Object p95/contention/storage-growth evidence before runtime acceptance |
-| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; exact receipt/envelope and authenticated evaluator-handoff binding; durable history CAS/replay/integrity/restart/capacity; pure same-execution fresh lifecycle projection; workflow-backed plan/session identity rejection before durable lookup plus fresh current Workflow / Task Execution read per decision; Policy / Approval CAS approval/revocation and replay/CAS integrity; live trust selection/non-workflow revocation/deployed-DO/fresh publication-time cross-authority reconciliation/graph-publication/canary evidence before activation |
+| Procedural graph guidance | exact schema/identity bounds; graph/session local admission; canonical digest behavior; cycle-safe bounded neighborhood extraction; unknown/budget abstention; paired holdout separation and exact candidate/base/context binding; safety and measured-score non-regression; `activationAuthorized: false`; exact receipt/envelope and authenticated evaluator-handoff binding; durable history CAS/replay/integrity/restart/capacity; pure same-execution fresh lifecycle projection; workflow-backed plan/session identity rejection before durable lookup plus fresh current Workflow / Task Execution read per decision; Policy / Approval CAS approval/revocation and replay/CAS integrity; protected #603 stable double-read publication preflight with `publicationAuthorized:false`; live trust selection/non-workflow revocation/deployed-DO/actual graph-publication/canary evidence before activation |
 | GitHub Actions/control plane | least privilege, exact-head/live-base binding, full pagination, stale-head refusal, evidence-class separation |
 | LLM integration | gateway contract, provider-key isolation, deterministic gates independent of model judgement |
 | release/acquisition | protected source, CI/security/coverage, package/SBOM/provenance/reproducibility, licensing/NOTICE, rollback/recovery, later operational/buyer evidence |
@@ -182,7 +186,7 @@ Repository source/docs cannot fabricate stronger live `main` governance than the
 
 Protected external-extension lifecycle source cannot establish actual Durable Object p95, contention/partition behavior, backup/restore success, production recovery, or deployed invocation enforcement by documentation alone. Those remain later exact operational evidence.
 
-Protected procedural-graph source can authenticate the supplied evaluator assertion, retain bounded evaluation/rejection history, and record source-level Policy / Approval CAS decisions through protected #601, but it cannot establish live signer/trust selection, cross-language/released digest semantics, non-workflow current-lifecycle revocation, deployed Workflow / Task, history-store or Policy / Approval behavior/performance, fresh publication-time reconciliation, graph publication, canary operation, rollback success, or production outcome improvement. Those remain later owner, contract, operational, and product-owner evidence.
+Protected procedural-graph source can authenticate the supplied evaluator assertion, retain bounded evaluation/rejection history, record source-level Policy / Approval CAS decisions through protected #601, and produce a stable point-in-time publication preflight through protected #603. It still cannot establish live signer/trust selection, cross-language/released digest semantics, non-workflow current-lifecycle revocation, deployed Workflow / Task, history-store or Policy / Approval behavior/performance, actual graph publication, canary operation, rollback success, or production outcome improvement. The #603 receipt itself remains `publicationAuthorized:false` and `activationAuthorized:false`; those later authorities remain owner, contract, operational, and product-owner evidence.
 
 ## 12. Canonical documentation graph
 
@@ -207,6 +211,6 @@ The default shape is **small credential-exchange service + explicit state coordi
 
 The external-extension lifecycle remains a bounded Tool Capability / State / Checkpoint aggregate rather than a new scanner, quarantine runtime, egress engine, identity provider, or model router. Its synchronous projection path and full audit/recovery path are deliberately separate so buyer/runtime latency does not require scanning retained history while recovery still verifies the complete chain.
 
-The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. Its pure execution adapter may project localized context against a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot. Protected #589 adds only a workflow-backed current-state ACL over the existing canonical Workflow / Task Execution owner. Protected #597 adds a separate bounded State / Checkpoint history for evaluation/rejection evidence, not a second Workflow / Task or lifecycle truth. Protected #601 adds the distinct Noema Policy / Approval CAS ledger without granting publication or activation. Any future release, live signer-trust selection, graph publication, non-workflow current-lifecycle revocation, publication-time cross-authority reconciliation, canary, or activation path must cross explicit versioned owner contracts and retain `activationAuthorized:false` until those independent authorities are proven.
+The protected procedural-graph advisory remains a bounded Agent Runtime aggregate rather than an execution engine or autonomous policy plane. Its pure execution adapter may project localized context against a caller-supplied fresh authenticated same-execution `running` lifecycle snapshot. Protected #589 adds only a workflow-backed current-state ACL over the existing canonical Workflow / Task Execution owner. Protected #597 adds a separate bounded State / Checkpoint history for evaluation/rejection evidence, not a second Workflow / Task or lifecycle truth. Protected #601 adds the distinct Noema Policy / Approval CAS ledger without granting publication or activation. Protected #603 adds only the stable publication preflight read boundary and keeps `publicationAuthorized:false` and `activationAuthorized:false`; any future release, live signer-trust selection, graph publication, non-workflow current-lifecycle revocation, canary, or activation path must still cross explicit versioned owner contracts and prove those independent authorities.
 
 Architecture changes must keep source behavior, realistic regression tests, canonical documentation, traceability, and CHANGELOG semantics consistent without promoting active-PR behavior to protected truth.

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required.
 
 ## Unreleased
+- Noema Policy / Approval에 procedural graph **publication preflight**를 추가했다. PR #603에서 current State / Checkpoint history와 Policy / Approval snapshot을 stable double-read로 다시 읽어 moving authority와 current revoke를 실패-폐쇄하고 exact graph/history/evaluator handoff/signer/approval identity를 결합한다. 반환되는 process-local preflight receipt는 `publicationAuthorized:false`와 `activationAuthorized:false`를 유지한다. 실제 graph publication, current lifecycle/revocation, live Keyverse/owner trust, immutable released `context-graph-contracts`, canary/rollback 및 production outcome authority는 별도다.
 - Policy / Approval에 procedural graph lineage의 독립 승인·취소 CAS 원장을 추가한다. 기존 Agent Runtime이 admit한 exact graph와 State / Checkpoint가 provenance-preserving read authority로 반환한 verified evaluation history를 exact candidate/history/evaluator handoff identity에 결합하고, monotonic approval-version CAS·exact decision replay·explicit revoke·bounded digest-chain integrity를 검증한다. structural clone history/approval snapshot, stale writer, malformed 또는 mismatched independent decision과 retained-byte integrity 위반은 실패-폐쇄하며 모든 event/snapshot은 `activationAuthorized:false`를 유지한다. Keyverse signer/key custody, graph publication, immutable release/deployment/canary, tool/model/provider routing과 product/domain truth는 이 경계 밖이다. issue #584, PR #601.
 - State / Checkpoint의 durable procedural evaluation history에 provenance-preserving read authority를 추가한다. canonical repository가 retained bytes와 graph lineage를 검증해 반환한 immutable snapshot만 process-local admission으로 표시하고, structural clone·deserialized lookalike·append-return snapshot·caller-created object·null은 downstream Policy / Approval anti-corruption boundary에서 authority로 오인되지 않도록 실패-폐쇄한다. 이 표시는 읽은 시점의 verified provenance만 증명하며 이후 append에 대한 currentness, Policy / Approval decision, graph publication/promotion 또는 activation authority를 부여하지 않는다. issue #584, PR #599.
 - State / Checkpoint에 authenticated procedural evaluation/rejection history를 추가한다. 기존 Agent Runtime이 admit한 exact graph/evaluation/handoff identity만 tenant/task/graph lineage별 bounded complete event chain으로 저장하고 monotonic CAS·exact replay·digest-chain integrity·durable rejection projection을 검증한다. stale writer, rejection-context omission, structural forgery, wrong lineage, retained-byte corruption, duplicate handoff, 128-event capacity 초과는 실패-폐쇄하며 eviction은 하지 않는다. 이 저장소는 Workflow / Task lifecycle, Policy / Approval, graph publication/promotion 또는 activation authority를 만들지 않고 모든 event는 `activationAuthorized:false`를 유지한다. issue #584, PR #597.