docs(noema): converge #673 private-reporting cancellation authority

[seonghobae]

Purpose

Converge protected Noema #673 into canonical CHANGELOG/product-gap authority without promoting source integration to immutable release, deployment, production outcome, GitHub security-setting authority, provider routing, outbound policy, quarantine/security authority, or foreign domain truth.

Real RED

Test-only exact 66972713527c80a9a4fc9fcaedd54809706c7913 added the executable documentation-authority contract first. Hosted application CI 34692727666 passed exact checkout, Node/npm toolchain verification, live-base/lockfile controls, install and release typecheck, then failed in release tests exactly at test/private-vulnerability-reporting-cancellation-authority.test.ts:10 because the baseline did not contain merged #673 exact 6f9dc4ca047817e4c9ef5ae8a55816493b1c558d (1 failed / 4736 passed). No documentation repair was applied before that RED existed.

Repair finding during GREEN attempt

Documentation head e076a5140bc7907e09bf36afb52f04e250df6ed1 failed application CI 34693229573 after checkout/toolchain/live-base/install/typecheck because the baseline rewrite had dropped the exact existing #670 authority sentence required by test/orchestrator-health-cancellation-authority.test.ts: #670 remains protected source evidence; immutable release and deployed availability/p95 evidence remain separate. The test was not weakened or removed. The baseline was repaired to retain that protected predecessor contract, and two incidental section-spacing deletions were also restored so they do not remain in the PR delta.

Minimal causal repair

Current exact head dd9e3f56417390e9cf45c9a3c2707c50e350e72d records only the missing canonical authority while retaining #670:

• CHANGELOG.md: one fix(security): preserve private-reporting oversize failure through cleanup faults #673 Unreleased entry; no historical entry is removed or rewritten.
• docs/product-technical-gap-baseline.md: dated protected observation/history advances to the verified fix(security): preserve private-reporting oversize failure through cleanup faults #673 merge; bounded-reader lineage records the 16 KiB private-reporting cancellation classification, reader-lock semantics, release/deployment evidence separation, foreign-authority boundary, and preserves the exact fix(noema): bound orchestrator health cancellation latency #670 evidence-separation sentence.
• executable contract remains as the regression oracle.

Runtime source is unchanged. The effective PR delta is CHANGELOG +1/−0, baseline three semantic replacements with predecessor authority preserved, and one +30-line regression test. No force push, destructive rebase, self-approval, or gate weakening.

All four exact-head hosted gates plus review/thread verification are required before normal merge.

Summary by CodeRabbit

• 버그 수정

  • 비공개 취약점 보고 응답이 허용된 크기를 초과할 때, 스트리밍 정리 과정에서 오류가 발생해도 크기 제한 오류가 안정적으로 표시됩니다.
  • 기존 응답 크기 제한, 미디어 유형 검증, UTF-8 및 중복 키 검증 동작은 그대로 유지됩니다.

• 문서

  • 관련 변경 사항과 보호된 상태 기록을 최신화했습니다.

• 테스트

  • 크기 제한 및 정리 실패 상황에 대한 검증을 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: ab47994b-4808-4e11-88db-85a9d7afe4ce

📥 Commits

Reviewing files that changed from the base of the PR and between 185dcc2 and dd9e3f5.

📒 Files selected for processing (3)

• CHANGELOG.md
• docs/product-technical-gap-baseline.md
• test/private-vulnerability-reporting-cancellation-authority.test.ts

---

📝 Walkthrough

Walkthrough

PR #673의 bounded reader 취소 정리 동작을 변경 로그와 기준선 문서에 기록한다. 새 테스트는 보호된 상태, 권한 비승격, size-limit failure 분류를 검증한다.

Changes

취소 정리 동작 기록 및 검증

Layer / File(s)	Summary
기준선 및 변경 로그 갱신 CHANGELOG.md, docs/product-technical-gap-baseline.md	PR #673의 보호된 관찰 SHA와 이력을 갱신한다. 16 KiB 초과 후 동기식 reader.cancel() 오류가 안정적인 size-limit failure를 대체하지 않으며, 비동기 cancellation rejection은 best-effort cleanup으로 유지되고 consumed reader lock은 독립적으로 해제됨을 기록한다.
권한 및 분류 검증 test/private-vulnerability-reporting-cancellation-authority.test.ts	기준선 문서, 변경 로그, 감사 스크립트에 PR #673의 보호 상태가 기록되었는지 확인한다. 보안·릴리스·외부 권한 승격이 없고 Noema로 설정 권한이 이전되지 않았으며, size-limit failure 분류가 유지되는지 검증한다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/private-vuln-cancel-authority-20260912

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head review for dd9e3f56417390e9cf45c9a3c2707c50e350e72d: diff is limited to CHANGELOG, product-gap authority, and the executable documentation regression; the earlier #670 authority-loss regression is restored; runtime source is unchanged; no foreign provider/outbound/quarantine/security authority is imported. Hosted ci, reviewer-ci, Security Scan, and patch-validator-image are all terminal SUCCESS on this exact head, and there are no unresolved inline review threads. This is evidence for normal merge only, not immutable release/deployment/production outcome evidence.