docs(agent-runtime): classify #652 as protected response-bound authority

[seonghobae]

Finding

Protected main@ac762f118021c8eb2cba16563722ed83c0fd3437 includes normal-merged #652, which bounds the private Workflow / Task Execution response consumed by Agent Runtime's current-state procedural ACL. Canonical documentation had stopped at the older #589/#603 description: CHANGELOG.md had no #652 entry, ADR-0017 did not record the retained-byte admission boundary and still called already-protected #603 a candidate in several places, and docs/product-technical-gap-baseline.md did not classify #652 in the protected procedural lineage.

Reality RED

Test-only exact 24338652141455120da0e96eb5f83abb530759e8 extended the existing protected-documentation contract before any canonical document repair. Hosted application CI 34649479089 checked out that exact head, passed checkout/base/toolchain/install/typecheck, and failed at release tests on the new documentation assertions. This establishes a source-real documentation RED rather than an infrastructure failure.

Causal repair and exact-head RCA

The documentation repair records #652 and its 1 MiB retained-byte ceiling in CHANGELOG.md, keeps ADR-0017 Proposed while documenting the fixed retained buffer and fail-closed private-response admission, and advances the commercial baseline to the verified #652 protected lineage without promoting release/deployment authority. Review also found that an intermediate whole-file edit had accidentally changed an unrelated changelog sentence and dropped two historical bullets; exact d6245a63616ca00e477965b429c738d1b6e22623 restored those unrelated bytes so the CHANGELOG delta is only the #652 entry.

Hosted CI 34650590857 then failed at release tests because test/procedural-publication-preflight-documentation.test.ts still required the pre-merge phrase Candidate #603 adds..., although #603 is already protected. Exact 09759a8e92f7cbac945655505924b9bfc035c8f3 repaired that stale assertion without changing publication/activation authority.

The next hosted CI 34652142784 again passed checkout/base/toolchain/install/typecheck and failed at release tests. The remaining failure was another stale documentation contract: test/documentation-retention-hardening-current.test.ts hard-coded #650's former protected-main observation 65e8bb7... as if it were evergreen, while the baseline explicitly states dated protected SHAs are historical evidence and #652 has since advanced protected main. Commit 41ff085c89e27a97a00ce85ced968931f506a147 removes only that stale evergreen-SHA assertion and retitles the test to preserve #650's exact historical lineage after later protected-main advancement; all #642–#650 exact-history and retained-memory evidence assertions remain.

Current exact is 41ff085c89e27a97a00ce85ced968931f506a147. Fresh hosted exact-head gates are required; predecessor GREEN will not be reused.

Boundary

This lane changes documentation authority and its executable documentation contracts only. It does not alter Agent Runtime runtime behavior, Workflow / Task truth, graph publication/activation, provider routing, isolation/security/outbound authority, or release/deployment evidence. ADR-0017 remains Proposed; protected source integration is not an immutable Noema release or deployed Durable Object p95/recovery evidence.

Summary by CodeRabbit

• 문서

  • Agent Runtime의 현재 상태 ACL 응답에 최대 1MiB 제한과 청크 단위 검증을 적용하는 보호 사항을 문서화했습니다.
  • 응답 초과 시 안전하게 실패하며, UTF-8·JSON 및 실행 계획 검증이 유지됨을 명시했습니다.
  • 관련 보호 항목과 배포·활성화 권한 제한을 ADR 및 기술 기준 문서에 반영했습니다.

• 테스트

  • 보호된 응답 한도와 권한 제한에 대한 문서 계약 검증을 추가·갱신했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4035b58c-30d9-4652-97fc-4cf44155c9bf

📥 Commits

Reviewing files that changed from the base of the PR and between ac762f1 and 41ff085.

📒 Files selected for processing (6)

• CHANGELOG.md
• docs/adr/0017-procedural-graph-guidance.md
• docs/product-technical-gap-baseline.md
• test/documentation-retention-hardening-current.test.ts
• test/procedural-protected-documentation-contract.test.ts
• test/procedural-publication-preflight-documentation.test.ts

---

📝 Walkthrough

Walkthrough

PR #652의 Agent Runtime 응답 상한과 PR #603의 게시 사전 점검 상태를 CHANGELOG, ADR, baseline 문서에 반영했습니다. 관련 문서 계약 테스트도 갱신했습니다.

Changes

절차적 그래프 보호 문서

Layer / File(s)	Summary
응답 상한 보호 항목 CHANGELOG.md, docs/adr/0017-procedural-graph-guidance.md	PR #652의 고정 Uint8Array 기반 1 MiB 응답 상한과 실패-폐쇄 조건을 기록했습니다.
게시 사전 점검 상태 docs/adr/0017-procedural-graph-guidance.md, test/procedural-publication-preflight-documentation.test.ts	PR #603의 상태를 Candidate에서 Protected로 변경하고 게시·활성화 권한이 없음을 검증합니다.
Protected baseline 및 문서 계약 docs/product-technical-gap-baseline.md, test/documentation-retention-hardening-current.test.ts, test/procedural-protected-documentation-contract.test.ts	Protected history와 PR #652의 bounded-read 상태를 baseline에 반영했습니다. 관련 문서 문자열과 Proposed 상태를 테스트합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/procedural-current-response-bound-20260912

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review on exact d6245a63616ca00e477965b429c738d1b6e22623: the documentation/test delta is now causal and owner-bounded. The intermediate CHANGELOG collateral edit was repaired; final CHANGELOG diff is only the #652 entry. ADR-0017 remains Proposed, the baseline keeps release/deployment/p95/recovery as separate authority, and no Workflow / Task, provider-routing, isolation/security/outbound, or foreign-domain truth is copied. No unresolved source/documentation finding remains from this review. This is COMMENT-only, not approval; application ci is still queued and must reach terminal success on this unchanged exact head before Ready/merge.

[seonghobae]

Current-head review on 41ff085c89e27a97a00ce85ced968931f506a147: the lane remains documentation/executable-documentation only. The #652 1 MiB retained-byte boundary is classified as protected source without promoting release/deployment/runtime-performance authority; ADR-0017 remains Proposed. The stale #603 candidate assertion and the #650 evergreen-main-SHA assertion are repaired without dropping their historical contract assertions. No additional valid source, DDD, owner-boundary, authority-promotion, or test finding found; unresolved inline threads are 0. Merge remains contingent on fresh terminal-success gates for this exact head and an unchanged live base/head.