docs: converge protected current workflow media authority

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required.
 
 ## Unreleased
+- Protected #704 exact `42b15e865bdf88fde622c3bba2c0b123770d18be`, integrated by GitHub-verified normal merge `e8c2002e5af8fa5611880091dab81916bb716c35`, requires Agent Runtime to admit private Workflow / Task Execution current-state evidence only when a successful response declares the owner-emitted JSON media type `application/json; charset=utf-8` (media-type parameters remain acceptable). Missing or non-JSON media types fail closed with the stable `invalid_workflow_state_response` classification before bounded parsing. Rejected-media body cancellation is best-effort cleanup: synchronous throw, asynchronous rejection, null body, or non-settling cleanup cannot replace or delay the fail-closed decision. The existing fixed 1 MiB retained buffer, 10-second absolute read deadline, fatal UTF-8/JSON admission, canonical execution binding, and reader-lock lifecycle remain unchanged. Workflow / Task lifecycle truth, provider/model routing, destination/outbound policy, credential authority, quarantine/security, Policy / Approval, State / Checkpoint, release/deployment, and foreign-domain authority remain with their existing owners; protected source/checks/merge are not an immutable release, deployed Durable Object recovery, or production p95/heap evidence.
 - Protected #702 exact `2b31805eb2b81b6078fefe1ebcce8007b6ca5169`, integrated by GitHub-verified normal merge `cf7f4279dbf83213557e987f0ee8fb52b12fcccf`, behaviorally verifies Noema's shared Cloudflare deploy/status/recovery request boundary rather than relying on source-text header presence. The three direct clients use `requestCloudflareJson`; executable tests observe the actual `fetch` request, require `Accept: application/json` and the owner bearer to override conflicting caller values, preserve unrelated caller headers such as `Content-Type`, enforce the existing 120-second request deadline, and continue into the 1 MiB bounded JSON reader. `Accept` remains request-side representation preference rather than provider response-shape authority. Cloudflare/provider truth, destination/outbound policy, credential authority, quarantine/security, recovery-state, release/deployment and foreign-domain authority remain with their existing owners; protected source/test/CI evidence is not an immutable release, production deployment, controlled recovery rehearsal, deployed p95/heap or production KPI evidence.
 - PR #701 source exact `80d3d579ad4a08ccb3f21e2735c7fb0bebc7b492` makes Noema's direct Cloudflare deploy/status/recovery control-plane clients explicitly negotiate machine-readable Cloudflare-generated errors with `Accept: application/json` before their existing 1 MiB bounded JSON response reader. Cloudflare's 2026-05-05 error-response contract documents HTML as the default for generated errors when `Accept` is absent or `*/*`, and structured JSON when `application/json` is requested; Noema still treats negotiation as preference rather than shape authority and retains fail-closed fatal UTF-8/JSON/provider-error admission. Existing 120-second request bound, fixed retained buffer, reader/cancellation lifecycle, exact recovery-state checks, credential capability, destination/outbound policy, Cloudflare/provider authority and release/deployment authority remain unchanged. This source PR is not an immutable release, production deployment, controlled recovery rehearsal, or deployed p95/heap evidence.
 - Protected #699 bounds Agent Runtime's private Workflow / Task Execution current-state response read at exact source `e52408745efc73351c098227ae4c85c309fdd0c9` with a 10-second absolute read deadline. Deadline expiry preserves the stable `invalid_workflow_state_response` fail-closed contract, requests reader cancellation only as best-effort cleanup, clears the deadline timer, and releases the reader lock on every terminal path. The existing fixed 1 MiB retained buffer, byte ceiling, fatal UTF-8/JSON admission, canonical execution binding, and Workflow / Task Execution ownership remain unchanged. Workflow / Task lifecycle, provider/model routing, outbound, credential, quarantine/security, release/deployment, and foreign-domain authority stay with their existing owners; this protected source is not an immutable release, deployed Durable Object recovery, or production p95/heap evidence. PR #699.
@@ -143,4 +144,4 @@
 - `/exchange` 401 응답에 `WWW-Authenticate: Bearer realm="noema"` challenge를 추가하고 인증 누락은 `invalid_request`, 잘못된 토큰은 `invalid_token`으로 구분.
 - `x-request-id`/`x-correlation-id` 및 client IP 계열 헤더를 길이/문자 기준으로 제한해 로그 오염과 rate-limit key 폭주를 방지.
 - `KRW 2,000,000,000` 매각 가능성 Goal 등록서, buyer due diligence index, library/submodule 경계 판단서를 추가하고 `npm run acquisition:audit`로 ARR/LOI/이전성/saleable evidence를 실패-폐쇄 방식으로 검증.
-- Protected #695 normalizes synchronous reader acquisition on the contextual-orchestrator `/healthz` response consumer at exact source `c9d526093e543167645383e937096fd089b337f8`. If a locked or otherwise non-stream-readable response body makes `response.body.getReader()` throw synchronously, Noema fails closed with `contextual-orchestrator health response body is not stream-readable` instead of leaking a runtime-specific stream exception. The existing 65,536-byte ceiling, optional caller-supplied deadline with no invented default timeout, fixed retained buffer, best-effort cancellation, fatal UTF-8, duplicate-key/JSON admission, and reader-lock lifecycle after successful acquisition remain unchanged. Contextual-orchestrator service/provider/model routing, credentials, outbound authority, quarantine/security authority, release/deployment authority, and foreign-domain truth remain with their existing owners; protected source is not an immutable release or deployed availability/p95/recovery evidence. PR #695.
+- Protected #695 normalizes synchronous reader acquisition on the contextual-orchestrator `/healthz` response consumer at exact source `c9d526093e543167645383e937096fd089b337f8`. If a locked or otherwise non-stream-readable response body makes `response.body.getReader()` throw synchronously, Noema fails closed with `contextual-orchestrator health response body is not stream-readable` instead of leaking a runtime-specific stream exception. The existing 65,536-byte ceiling, optional caller-supplied deadline with no invented default timeout, fixed retained buffer, best-effort cancellation, fatal UTF-8, duplicate-key/JSON admission, and reader-lock lifecycle after successful acquisition remain unchanged. Contextual-orchestrator service/provider/model routing, credentials, outbound authority, quarantine/security authority, release/deployment authority, and foreign-domain truth remain with their existing owners; protected source is not an immutable release or deployed availability/p95/recovery evidence. PR #695.

docs/product-technical-gap-baseline.md

@@ -154,3 +154,11 @@ The existing 65,536-byte ceiling, optional caller-supplied deadline with no inve
 Protected history includes merged PR #699 exact `e52408745efc73351c098227ae4c85c309fdd0c9`. Protected #699 closes the stalled-read liveness gap on Agent Runtime's private Workflow / Task Execution current-state response path: after successful reader acquisition, a 10-second absolute read deadline prevents an HTTP 200 response that never yields another chunk from pinning procedural guidance indefinitely. Deadline expiry preserves the stable `invalid_workflow_state_response` fail-closed contract, requests cancellation only as best-effort cleanup, clears the deadline timer, and releases the reader lock on every terminal path.
 
 The existing fixed 1 MiB retained buffer, byte ceiling, fatal UTF-8/JSON admission, canonical execution binding, and Workflow / Task Execution ownership remain unchanged. #699 remains protected source/test evidence; immutable release, deployed Durable Object recovery, and production p95/heap evidence remain separate. Workflow / Task lifecycle, provider/model routing, outbound, credential, quarantine/security, release/deployment, and foreign-domain authority stay with their existing owners.
+
+## Protected procedural current-lifecycle media admission — merged PR #704
+
+Protected history includes merged PR #704 exact `42b15e865bdf88fde622c3bba2c0b123770d18be`, integrated by GitHub-verified normal merge `e8c2002e5af8fa5611880091dab81916bb716c35`. Protected #704 closes the representation-admission gap on Agent Runtime's private Workflow / Task Execution current-state response path: successful owner evidence must identify its representation as `application/json; charset=utf-8` before Noema performs bounded procedural-state parsing, while equivalent JSON media-type parameters remain admissible. Missing or non-JSON media types fail closed with the stable `invalid_workflow_state_response` classification.
+
+Rejected-media response-body cancellation is best-effort cleanup only: synchronous cleanup throw, asynchronous rejection, null body, or non-settling cancellation cannot replace or delay the fail-closed decision. The existing fixed 1 MiB retained buffer, byte ceiling, 10-second absolute read deadline, fatal UTF-8/JSON admission, canonical execution binding, and reader-lock lifecycle after successful acquisition remain unchanged.
+
+#704 remains protected source/test evidence; immutable release, deployed Durable Object recovery, and production p95/heap evidence remain separate. Workflow / Task lifecycle truth stays with its Durable Object owner. #704 does not transfer provider/model routing, destination/outbound policy, credential authority, quarantine/security, Policy / Approval, State / Checkpoint, release/deployment, or foreign-domain authority into Agent Runtime.

test/procedural-current-lifecycle-media-authority.test.ts

@@ -0,0 +1,31 @@
+import { readFileSync } from "node:fs";
+
+import { describe, expect, it } from "vitest";
+
+describe("protected procedural current-lifecycle media documentation authority", () => {
+  it("records protected #704 without promoting Workflow / Task or production authority", () => {
+    const baseline = readFileSync("docs/product-technical-gap-baseline.md", "utf8");
+    const changelog = readFileSync("CHANGELOG.md", "utf8");
+    const source = readFileSync("src/agent-runtime/procedural-current-lifecycle.ts", "utf8");
+
+    expect(changelog).toContain("Protected #704");
+    expect(changelog).toContain("42b15e865bdf88fde622c3bba2c0b123770d18be");
+    expect(changelog).toContain("e8c2002e5af8fa5611880091dab81916bb716c35");
+    expect(changelog).toContain("application/json; charset=utf-8");
+    expect(changelog).toContain("invalid_workflow_state_response");
+    expect(changelog).toContain("best-effort cleanup");
+
+    expect(baseline).toContain(
+      "merged PR #704 exact `42b15e865bdf88fde622c3bba2c0b123770d18be`",
+    );
+    expect(baseline).toContain("GitHub-verified normal merge `e8c2002e5af8fa5611880091dab81916bb716c35`");
+    expect(baseline).toContain("application/json; charset=utf-8");
+    expect(baseline).toContain("stable `invalid_workflow_state_response`");
+    expect(baseline).toContain("best-effort cleanup");
+    expect(baseline).toContain("immutable release");
+    expect(baseline).not.toContain("#704 transfers Workflow / Task lifecycle authority to Agent Runtime");
+
+    expect(source).toContain("function isJsonMediaType(value: string | null): boolean");
+    expect(source).toContain("Noema current workflow-state response used an unsupported media type");
+  });
+});