docs: converge #691 vulnerability-reporting reader authority

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required.
 
 ## Unreleased
+- Protected #691 normalizes reader acquisition on the read-only private-vulnerability-reporting audit at exact source `65e0d3dd3c4060ba0057ba13cf6c9ea23b03373d`. If an already locked or otherwise non-stream-readable GitHub response body makes `response.body.getReader()` throw synchronously, Noema fails closed with the stable `GitHub private vulnerability reporting response body could not be read.` diagnostic. Existing 16 KiB response ceiling, JSON media-type gate, fatal UTF-8, duplicate-key and JSON admission, best-effort oversize cancellation, and reader-lock cleanup after successful acquisition remain unchanged. GitHub private-vulnerability-reporting setting, security, outbound, credential, release/deployment, and foreign-domain authority remain with their existing owners; protected source is not an immutable release, production deployment, live private-vulnerability-reporting enablement or notification staffing, recovery rehearsal, or deployed p95/heap evidence. PR #691.
 - Protected #689 normalizes reader acquisition on the public `/exchange` bounded JSON request body at exact source `b838c352a7cd0f7f58a905857537a3a9675a56f2`. If an already locked or otherwise non-stream-readable body makes `request.body.getReader()` throw synchronously, Noema returns the established `400` / `ERR_VALIDATION_INPUT` / `unreadable` contract before credential egress. Existing 8,192-byte ceiling, 10-second absolute deadline, media-type and JSON admission, best-effort cancellation, and reader-lock cleanup after successful acquisition remain unchanged. Provider/model routing, destination/outbound policy, credential authority, quarantine/security authority, release/deployment authority, and foreign-domain truth remain with their existing owners; protected source is not an immutable release, production deployment, recovery rehearsal, or deployed p95/heap evidence. PR #689.
 - Protected #687 normalizes reader acquisition on the distributed `/exchange` private Durable Object rate-limit transport. If an already locked/non-stream-readable 256-byte internal request makes `request.body.getReader()` throw synchronously, it returns the established `400 malformed_json` contract before storage authority; a locked 4,096-byte decision response fails closed with the stable `rate-limit Durable Object decision body could not be read` diagnostic. Existing fixed retained buffers, byte ceilings, best-effort cancellation, reader-lock release after successful acquisition, fatal UTF-8·duplicate-key·JSON admission, and bucket/identity/Durable Object authority remain unchanged. Provider/model routing, destination/outbound policy, credential authority, quarantine/security authority, release/deployment authority, and foreign-domain truth remain with their existing owners; this protected source is not an immutable release or deployed recovery/p95/heap evidence. PR #687.
 - Protected #685 normalizes reader acquisition on Noema's OIDC replay guard bounded transport. If an already locked/non-stream-readable 4,096-byte decision response makes `response.body.getReader()` throw synchronously, the reader now fails closed with the stable `OIDC replay guard decision body could not be read` diagnostic; a locked 512-byte internal claim request returns the established `400 malformed_json` contract before Durable Object storage authority. Existing fixed retained buffers, byte ceilings, best-effort cancellation, reader-lock release after successful acquisition, fatal UTF-8·duplicate-key·JSON admission, and replay/storage authority remain unchanged. OIDC/GitHub identity, provider/model routing, destination/outbound policy, credential, quarantine/security, release/deployment, and foreign-domain authority remain with their existing owners; this protected source is not an immutable release or deployed recovery/p95/heap evidence. PR #685.

docs/product-technical-gap-baseline.md

@@ -28,6 +28,8 @@ Protected #687 exact `98ec07552f4081bd4ff6b25f1f3ed691c0f3f2b9`은 distributed `
 
 Protected #689 exact `b838c352a7cd0f7f58a905857537a3a9675a56f2`은 public `/exchange` request-edge JSON admission에서 reader acquisition itself를 fail-closed boundary로 완성한다. 이미 locked or otherwise non-stream-readable `/exchange` request body 때문에 `request.body.getReader()`가 동기적으로 throw하면 raw stream exception을 Worker 경계 밖으로 흘리지 않고 stable `400` / `ERR_VALIDATION_INPUT` / `unreadable` contract before credential egress로 정규화한다. 기존 8,192-byte wire ceiling, 10-second absolute deadline, `application/json` media-type gate, duplicate-key/shape/unknown-field checks, best-effort cancellation과 successful reader acquisition 이후 terminal lock cleanup은 그대로 유지된다. #689 source integration is not immutable release, production deployment, recovery rehearsal, or deployed p95/heap evidence. #689 retains provider/model routing, destination/outbound policy, credential, quarantine/security, release/deployment, and foreign-domain authority with their existing owners.
 
+Protected #691 / merged PR #691 exact `65e0d3dd3c4060ba0057ba13cf6c9ea23b03373d` is retained at protected main `b199ad1f0bed0ecd545e46e327e0bed6fff9224e` and normalizes reader acquisition on the read-only private-vulnerability-reporting audit. If an already locked or otherwise non-stream-readable GitHub response body makes `response.body.getReader()` throw synchronously, Noema fails closed with the stable `GitHub private vulnerability reporting response body could not be read.` diagnostic. The existing 16 KiB response ceiling, JSON media-type gate, fatal UTF-8, duplicate-key and JSON admission, best-effort oversize cancellation, and reader-lock cleanup after successful acquisition remain unchanged. #691 source integration is not immutable release, production deployment, live private-vulnerability-reporting enablement or notification staffing, recovery rehearsal, or deployed p95/heap evidence. #691 retains GitHub private-vulnerability-reporting setting, security, outbound, credential, release/deployment, and foreign-domain authority with their existing owners.
+
 Baseline의 요구·설계·데이터·경계 authority는 `docs/PRD.md`, `docs/TRD.md`, `docs/UML.md`, `docs/ERD.md`, `docs/CONTEXT_MAP.md`다. 이 register는 그 문서와 ADR을 대체하지 않고 current Gap/Action/Status를 exact source·PR·workflow evidence에 결합한다. ADR 0015는 protected source에 포함됐지만 상태는 `Proposed`이며 production activation-authority integration, deployed lifecycle operability/recovery evidence, immutable shared-contract consumption, live pilot와 release evidence가 남아 있다. ADR 0017도 `Proposed`다. ADR 0018도 `Proposed`이며 protected #612/#614/#616/#618/#620/#665/#683 source는 recovery command semantics, provider-state verification, bounded Cloudflare control-plane response transport·retained-heap bound·oversize cancellation-liveness·locked-reader acquisition normalization을 보호하지만 controlled production recovery rehearsal, immutable release, SLO 또는 production outcome의 증거가 아니다.
 
 Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechanics를 구현했고 protected #585/#586/#589 lineage는 기존 Workflow / Task Execution authority를 current-state ACL로 재사용한다. Protected #603 + #652 + #663 + #678 lineage에서 #603 publication preflight는 current State / Checkpoint와 Policy / Approval을 안정적인 double-read window에서 다시 읽고 exact graph/history/evaluator/signer/approval identity를 결합하고, #652는 그 Agent Runtime current-state ACL의 private Workflow / Task Execution response를 **fixed 1 MiB retained buffer**로 제한한다. #663은 oversize chunk를 copy 전에 실패-폐쇄하는 경계를 유지하면서 cancellation completion is best-effort cleanup으로 분리해 stalled cancellation이 안정적인 거부 결정을 지연하지 않게 하고, reader lock은 cleanup 성공과 독립적으로 terminal path에서 해제한다. #678은 reader acquisition 자체를 untrusted response boundary로 다뤄 이미 locked response body에서 `getReader()`가 동기 예외를 내도 안정적인 `invalid_workflow_state_response`로 실패-폐쇄한다. 이 transport hardening은 Workflow / Task lifecycle, graph publication 또는 activation authority를 추가하지 않는다. Protected #597은 bounded durable evaluation/rejection history를 기존 State / Checkpoint에 추가했고 #601은 별도 Noema Policy / Approval CAS를 추가했다. #603 preflight는 `publicationAuthorized:false`와 `activationAuthorized:false`를 유지한다. 실제 graph publication, current non-workflow lifecycle/revocation, live Keyverse/owner signer trust, released wire contract, deployed p95/recovery evidence, canary/rollback과 product outcome은 별도 authority다.
@@ -37,7 +39,6 @@ Protected #585/#586은 bounded Noema Agent Runtime advisory graph/session mechan
 Protected #556는 raw source context가 producer-authenticated finding authority로 자동 승격되지 않도록 exact claim/run evidence와 generic research receipt kernel을 결합한다. Source integration은 execution/research producer, immutable Noema release 또는 released central consumer를 증명하지 않는다.
 
 #607의 `trusted-research-retrieval@v1` byte-integrity adapter는 protected source다. 이 adapter는 이미 retrieval된 immutable bytes와 비어 있지 않은 exact excerpt byte sequence만 받고, excerpt가 retrieved bytes 안에 verbatim으로 존재할 때만 기존 generic research receipt kernel에 위임한다. Text decoding/normalization, whitespace folding, paraphrase matching, source selection, network retrieval, Zotero/OA truth 또는 model-selected source authority를 추가하지 않는다. live trusted retrieval producer/handoff는 `ContextualWisdomLab/.github#2087` owner path의 별도 prerequisite다. execution framing은 `ContextualWisdomLab/.github#2086` owner path의 별도 prerequisite다. immutable Noema release와 released central consumer도 별도 #555 completion evidence로 남는다.
-
 ## Integrated external-extension admission — issue #545 / merged PR #560
 
 PR #560 exact `5aab7c098f3478069127f34e398326415ec599a4`는 application CI `34289599257`, reviewer-ci, required Security Scan, patch-validator-image `34289599248` terminal SUCCESS와 clean exact-head review authority를 충족한 뒤 normal merge됐다. Resulting protected merge는 GitHub-verified `e3aa77c3f678336c548440f355f988345b0ba976`다. 이 integration은 source/catalog/scanner authority와 Noema Policy / Approval issuance를 분리하고, Noema Policy / Approval issuance가 product/role/time grant를 소유하도록 한다.

test/documentation-private-vulnerability-locked-reader-current.test.ts

@@ -0,0 +1,37 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const changelog = readFileSync("CHANGELOG.md", "utf8");
+const baseline = readFileSync("docs/product-technical-gap-baseline.md", "utf8");
+
+describe("#691 private-vulnerability-reporting locked-reader documentation authority", () => {
+  it("keeps the protected source lineage and fail-closed audit contract current", () => {
+    expect(changelog).toContain(
+      "#691 normalizes reader acquisition on the read-only private-vulnerability-reporting audit",
+    );
+    expect(changelog).toContain(
+      "`65e0d3dd3c4060ba0057ba13cf6c9ea23b03373d`",
+    );
+    expect(baseline).toContain(
+      "Dated protected observation for this repair는 `main@620b29fae9a5dad5d463aff83dd6adb6b67f9305`이다.",
+    );
+    expect(baseline).toContain(
+      "Protected #691 / merged PR #691 exact `65e0d3dd3c4060ba0057ba13cf6c9ea23b03373d` is retained at protected main `b199ad1f0bed0ecd545e46e327e0bed6fff9224e`",
+    );
+    expect(baseline).toContain(
+      "GitHub private vulnerability reporting response body could not be read.",
+    );
+    expect(baseline).toContain(
+      "16 KiB response ceiling, JSON media-type gate, fatal UTF-8, duplicate-key and JSON admission",
+    );
+  });
+
+  it("does not promote audit source integration into foreign setting or release authority", () => {
+    expect(baseline).toContain(
+      "#691 source integration is not immutable release, production deployment, live private-vulnerability-reporting enablement or notification staffing, recovery rehearsal, or deployed p95/heap evidence",
+    );
+    expect(baseline).toContain(
+      "#691 retains GitHub private-vulnerability-reporting setting, security, outbound, credential, release/deployment, and foreign-domain authority with their existing owners",
+    );
+  });
+});