docs(release): converge protected #710 authority

CHANGELOG.md

@@ -3,6 +3,7 @@
 - Add a Noema-owned exact-claim evidence receipt contract whose execution and research producers serialize one canonical artifact that binds every receipt semantic field, including command/result/isolation/network or source revision/excerpt/retrieval policy. Admission accepts only a receipt ID from untrusted model output. The owner API first verifies the exact authenticated OpenCode-handoff manifest digest, canonical envelope bytes, reviewed producer-to-kind policy, and repository/head/workflow/run/attempt identity before it can construct an immutable typed index; admission then reconstructs each canonical artifact and verifies time/claim/artifact identity. The version-2 manifest now binds a separate producer-authenticated `ClaimEvidenceRequirement` containing the exact claim, independently required evidence kind, and `context` or `finding` publication authority. Raw current-head source lines are context only: they are withheld from finding-reference prompts and cannot publish a finding or `request_changes`; an explicitly producer-authorized source finding remains usable and retains exact path/line checks. Finding-free model `request_changes` and `blocked` verdicts cannot bypass receipt admission to publish a vacuous blocking review. Requirement/receipt kind mismatch, fixed-artifact semantic substitution, caller-supplied receipt dictionaries, model self-classification, stale identities, cross-kind receipts, marker-only sandbox output, noncanonical artifact bytes, and expired receipts fail closed before the GitHub publisher. This remains the owner prerequisite for ContextualWisdomLab/.github#1641 and issue #555. The reviewed `sandboxed_verify` adapter exists in owner source, but its actual central stdout/stderr/marker-to-manifest wiring and the trusted research producer are not yet integrated; exact-head hosted GREEN, immutable release, and the verified central consumer bump remain required.
 
 ## Unreleased
+- Protected #710 exact `8bc768756a10bab1d32b14039cdcfdb48d001931`, integrated by GitHub-verified normal merge `de0f3b5a9b5040ce4700a0888539f3d4f1d723bc`, binds tag-triggered immutable-release verification to the freshly resolved current protected `main`. The gate resolves only `refs/heads/main` from canonical `origin` with non-shell `git ls-remote --refs`, disables prompting, enforces a 20-second timeout and 16 KiB output ceiling, and admits exactly one canonical lowercase full SHA. Repository substitution, malformed or ambiguous ref output, noncanonical SHA identity, and any release-commit/current-main mismatch fail closed; pull-request and local verification remain network-independent. Protected #710 does not prove Release Policy Auditor provisioning, live immutable-release enablement, an immutable Noema Release, production deployment/recovery/KPI evidence, reproducibility/rollback completion, or legal/outbound-rights authority.
 - Protected #708 exact `8e4a35c28418fa3049e1dc13470088e8dacf2306`, integrated by GitHub-verified normal merge `2026878cc4627ef2cc781c9aa68da0e11b066fd1`, makes immutable buyer publication fail closed across the draft-staging race window. Before staging, the authenticated paginated release inventory must contain no release or retained draft for the tag; after the bounded six-asset draft is staged, the workflow requires exactly one total same-tag release, verifies that it is the mutable draft with a numeric release ID, verifies every staged asset name/size/GitHub SHA-256 digest, re-dereferences the tag, and publishes only that verified numeric release ID. A moved tag or same-tag ambiguity leaves the draft unpublished. Protected source does not prove live immutable-release enablement, Release Policy Auditor provisioning, an immutable Noema Release, production deployment/recovery/KPI evidence, reproducibility/rollback completion, or legal/outbound-rights authority.
 - PR #706 repairs immutable GitHub Release policy authorization: GitHub's repository immutable-release settings read requires `Administration: read`, so release publication no longer assumes the job `GITHUB_TOKEN` can prove that prerequisite. A dedicated repository-scoped Release Policy Auditor App token requests exactly `Administration: read` and `Metadata: read`, is admitted only through the owner-only bounded capability file, and is used only for the immutable-policy GET; exact-tag/release-absence checks and release creation/verification remain on the ordinary release job `GITHUB_TOKEN`. The existing Maintainer App is not broadened. Source integration does not prove App installation or credential provisioning, immutable-policy enablement, or an immutable Noema Release.
 - Protected #704 exact `42b15e865bdf88fde622c3bba2c0b123770d18be`, integrated by GitHub-verified normal merge `e8c2002e5af8fa5611880091dab81916bb716c35`, requires Agent Runtime to admit private Workflow / Task Execution current-state evidence only when a successful response declares the owner-emitted JSON media type application/json with optional `charset=utf-8` parameter; other media-type parameters are rejected. Missing or non-JSON media types fail closed with the stable `invalid_workflow_state_response` classification before bounded parsing. Rejected-media body cancellation is best-effort cleanup: synchronous throw, asynchronous rejection, null body, or non-settling cleanup cannot replace or delay the fail-closed decision. The existing fixed 1 MiB retained buffer, 10-second absolute read deadline, fatal UTF-8/JSON admission, canonical execution binding, and reader-lock lifecycle remain unchanged. Workflow / Task lifecycle truth, provider/model routing, destination/outbound policy, credential authority, quarantine/security, Policy / Approval, State / Checkpoint, release/deployment, and foreign-domain authority remain with their existing owners; protected source/checks/merge are not an immutable release, deployed Durable Object recovery, or production p95/heap evidence.
@@ -146,4 +147,4 @@
 - `/exchange` 401 응답에 `WWW-Authenticate: Bearer realm="noema"` challenge를 추가하고 인증 누락은 `invalid_request`, 잘못된 토큰은 `invalid_token`으로 구분.
 - `x-request-id`/`x-correlation-id` 및 client IP 계열 헤더를 길이/문자 기준으로 제한해 로그 오염과 rate-limit key 폭주를 방지.
 - `KRW 2,000,000,000` 매각 가능성 Goal 등록서, buyer due diligence index, library/submodule 경계 판단서를 추가하고 `npm run acquisition:audit`로 ARR/LOI/이전성/saleable evidence를 실패-폐쇄 방식으로 검증.
-- Protected #695 normalizes synchronous reader acquisition on the contextual-orchestrator `/healthz` response consumer at exact source `c9d526093e543167645383e937096fd089b337f8`. If a locked or otherwise non-stream-readable response body makes `response.body.getReader()` throw synchronously, Noema fails closed with `contextual-orchestrator health response body is not stream-readable` instead of leaking a runtime-specific stream exception. The existing 65,536-byte ceiling, optional caller-supplied deadline with no invented default timeout, fixed retained buffer, best-effort cancellation, fatal UTF-8, duplicate-key/JSON admission, and reader-lock lifecycle after successful acquisition remain unchanged. Contextual-orchestrator service/provider/model routing, credentials, outbound authority, quarantine/security authority, release/deployment authority, and foreign-domain truth remain with their existing owners; protected source is not an immutable release or deployed availability/p95/recovery evidence. PR #695.
+- Protected #695 normalizes synchronous reader acquisition on the contextual-orchestrator `/healthz` response consumer at exact source `c9d526093e543167645383e937096fd089b337f8`. If a locked or otherwise non-stream-readable `/healthz` response body makes `response.body.getReader()` throw synchronously, Noema fails closed with `contextual-orchestrator health response body is not stream-readable` instead of leaking a runtime-specific stream exception. The existing 65,536-byte ceiling, optional caller-supplied deadline with no invented default timeout, fixed retained buffer, best-effort cancellation, fatal UTF-8, duplicate-key/JSON admission, and reader-lock lifecycle after successful acquisition remain unchanged. Contextual-orchestrator service/provider/model routing, credentials, outbound authority, quarantine/security authority, release/deployment authority, and foreign-domain truth remain with their existing owners; protected source is not an immutable release or deployed availability/p95/recovery evidence. PR #695.