docs(agent-runtime): classify #652 as protected response-bound authority

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required.
 
 ## Unreleased
+- Agent Runtime의 workflow-backed procedural current-state ACL이 private Workflow / Task Execution Durable Object 응답을 `Response.json()`으로 선버퍼링하지 않고 고정 `Uint8Array`에 chunk-wise 수신해 **1 MiB retained-byte ceiling**을 적용한다. 한도를 넘는 chunk는 copy 전에 실패-폐쇄하고 stream cancellation failure가 안정적인 진단을 덮지 않으며 reader lock을 정리한다. Fatal UTF-8/JSON admission과 exact execution/plan/task 검증은 유지한다. 이 protected source는 immutable release, deployed Durable Object p95/recovery, graph publication 또는 activation authority를 대신하지 않는다. PR #652.
 - Distributed `/exchange` rate-limit의 private Durable Object request(256 bytes)와 decision response(4,096 bytes) bounded stream reader가 허용 chunk를 배열에 누적하지 않고 각 byte ceiling 크기의 고정 `Uint8Array`에 직접 복사하도록 바꾼다. 합법적인 high-fragmentation stream이 accepted-byte ceiling과 별개로 retained chunk object/backing-store 수와 두 번째 합산 allocation을 키우지 않으며 초과 chunk는 copy 전에 실패-폐쇄한다. 기존 cancellation, fatal UTF-8·duplicate-key·JSON admission, bucket/identity/Durable Object authority는 유지한다. 이 source hardening은 immutable release나 deployed heap/p95 evidence를 대신하지 않는다. PR #650.
 - Base credential-exchange의 OIDC discovery/JWKS·GitHub API bounded JSON response reader가 허용 chunk를 배열에 누적하지 않고 65,536-byte 고정 버퍼에 직접 복사하도록 바꾼다. Stream fragmentation이 accepted-byte ceiling과 별개로 retained chunk object/backing-store 수와 두 번째 합산 allocation을 키우지 않으며, 초과 chunk는 복사 전에 실패-폐쇄한다. 기존 10초 wall-clock deadline, cancellation, fatal UTF-8·duplicate-key·JSON admission, OIDC/GitHub identity·credential authority는 유지한다. 이 source hardening은 immutable release나 production p95/heap evidence를 대신하지 않는다. PR #646.
 - Workflow registry disable/plan 운영 경로의 GitHub JSON 응답 reader도 고정 `Uint8Array(MAX_RESPONSE_BYTES)`에 직접 수신해 합법적인 고분할 stream이 chunk-object retention과 두 번째 합산 allocation을 키우지 않도록 한다. Oversize는 copy 전에 실패-폐쇄하며 기존 pagination·registry identity·single-workflow disable authority는 유지한다. 이 source hardening은 live registry cleanliness나 immutable release evidence를 대신하지 않는다. PR #645.

docs/adr/0017-procedural-graph-guidance.md

@@ -71,6 +71,14 @@ execution-scoped private `read` command instead of accepting a cached caller-own
 task identities, canonical task states, cancellation identity, and monotonic
 transition sequence or the ACL fails closed.
 
+Protected #652 bounds that private response to a 1 MiB retained-byte ceiling with a
+fixed `Uint8Array` and chunk-wise pre-copy admission before JSON parsing. Oversize or
+malformed chunks, body-stream failure, invalid UTF-8/JSON and absent bodies fail closed;
+reader cancellation failure cannot replace the stable domain diagnostic and the lock
+is released. This transport hardening does not move Workflow / Task Execution truth
+into Agent Runtime, add lifecycle transitions, or prove deployed Durable Object
+latency, restart, recovery, heap, or release behavior.
+
 That durable read does **not** move Agent Runtime lifecycle truth into Workflow /
 Task Execution. It derives only a conservative guidance projection: current
 cancellation evidence suppresses advice; a fully terminal task vector suppresses
@@ -162,7 +170,7 @@ must separately honor current revocation. Keyverse/owner retains signer identity
 key custody; graph publication, released cross-service contracts, canary/rollback and
 product-owner outcome evidence remain outside this boundary.
 
-Candidate #603 adds a publication-time preflight under Noema Policy / Approval. It
+Protected #603 adds a publication-time preflight under Noema Policy / Approval. It
 freshly reads the existing State / Checkpoint history and Policy / Approval ledger
 twice, rejects movement inside that stable-read window, rejects a current revocation,
 and requires the exact candidate/history/evaluator-handoff/signer/approval identity
@@ -173,15 +181,15 @@ precondition evidence only and does not publish or activate a graph. A later pub
 must atomically/CAS-bind the exact receipt to its own operation plus immutable released
 external graph-contract and signer-trust inputs. Existing execution lifecycle and
 cancellation authority stay in Agent Runtime and Workflow / Task Execution rather than
-becoming graph-publication truth. ADR-0017 remains `Proposed` while #603 is candidate
-source and after source integration until release/deployment/shadow/canary evidence
-satisfies the separate acceptance boundaries.
+becoming graph-publication truth. ADR-0017 remains `Proposed` after #603 and #652 source
+integration until release/deployment/shadow/canary evidence satisfies the separate
+acceptance boundaries.
 
 ## CWL ownership and rollout
 
 | Owner | Planned responsibility; not a claim of deployed integration |
 | --- | --- |
-| Noema | Graph snapshot, guidance context, offline screening, signed evaluator-handoff verification, workflow-backed current-state guidance ACL, bounded State / Checkpoint evaluation/rejection history, provenance-preserving history reads, protected #601 Policy / Approval CAS, and candidate #603 publication-time preflight; graph publication/activation remains separate work |
+| Noema | Graph snapshot, guidance context, offline screening, signed evaluator-handoff verification, workflow-backed current-state guidance ACL with protected #652 response bound, bounded State / Checkpoint evaluation/rejection history, provenance-preserving history reads, protected #601 Policy / Approval CAS, and protected #603 publication-time preflight; graph publication/activation remains separate work |
 | context-graph-contracts | Released language-neutral schemas, digest rules, conformance fixtures |
 | enterprise-architecture-core | Capability/owner map, versioned adoption matrix and evidence classes |
 | contextual-orchestrator | Existing gateway routing for later guide/solver/refiner calls; no client-side provider fallback |
@@ -193,7 +201,7 @@ satisfies the separate acceptance boundaries.
 | .github and product owners | Central development profile and product-specific procedural graphs/adapters/tests |
 
 1. Keep the deterministic core, workflow-backed current-state ACL, authenticated
-   evaluator handoff, durable evidence history, Policy / Approval ledger, and candidate
+   evaluator handoff, durable evidence history, Policy / Approval ledger, and protected
    publication preflight advisory/evidence-only; none grants activation.
 2. Have contract/EAC owners release interoperable schemas and ownership records.
    Do not consume mutable sibling PR heads or independently copy this runtime.
@@ -203,7 +211,7 @@ satisfies the separate acceptance boundaries.
    duplicate effects, tokens/cost, and latency separately; do not invent gains.
 4. Reuse protected signed evaluator verification, State / Checkpoint durable rejection
    history, verified snapshot provenance, and #601 Policy / Approval CAS as prerequisites.
-   Candidate #603 adds fresh cross-authority reconciliation; sanitized trajectory
+   Protected #603 adds fresh cross-authority reconciliation; sanitized trajectory
    extraction, offline candidate generation, actual graph publication and recovery
    remain separate work and must not create duplicate truth.
 5. Enable opt-in canaries for other products only after their own conformance and
@@ -225,21 +233,23 @@ production caller integration, or organization-wide deployment is implied.
 
 The workflow-backed ACL closes only the caller-cache replay path when the current
 Workflow / Task Execution Durable Object itself contains newer cancellation or
-terminal task evidence. It is not a universal Agent Runtime lifecycle database and
-must not be advertised as one. Real runtime acceptance requires exact deployed
+terminal task evidence. Protected #652 additionally bounds the private owner response
+before JSON admission; neither change is a universal Agent Runtime lifecycle database
+or deployed performance/recovery proof. Real runtime acceptance requires exact deployed
 composition plus failure/restart and buyer-path latency evidence; the p95 <=20 ms
 target is measured against the deployed path rather than inferred from unit tests.
 
 There is still no production graph publication/trajectory store, automatic refiner,
-product invocation, or activation composition. Candidate #603 adds the missing
+product invocation, or activation composition. Protected #603 adds the missing
 publication-time State / Checkpoint + Policy / Approval reconciliation preflight, but
 that preflight is deliberately not an atomic publisher and carries no publication or
 activation authority. Protected #594 provides signed evaluator-handoff verification,
 #597 provides bounded durable evaluation/rejection history, #599 provides repository-
-verified read provenance, and #601 provides the Policy / Approval CAS ledger; none of
-those source slices, nor candidate #603, is release, deployment, graph publication,
-or activation authority. There is also no evidence yet that graph guidance improves
-CWL tasks. The owning root product/technical baseline must retain these gaps without
+verified read provenance, #601 provides the Policy / Approval CAS ledger, and #652
+bounds the private current Workflow / Task response retained before Agent Runtime
+admission; none of those source slices is release, deployment, graph publication, or
+activation authority. There is also no evidence yet that graph guidance improves CWL
+tasks. The owning root product/technical baseline must retain these gaps without
 replacing historical results. Do not mark ADR-0017 Accepted, publish a release, or
 advertise organization-wide activation from source integration or tracking issues.