feat(reviewer): bind external evidence receipts to exact claims and runs

[seonghobae]

Current authority — protected reviewer admission, producer/release handoff still open

Fresh protected Noema is GitHub-verified main@f38962869307a45b3b6e65692b2acbabb075e0eb, the normal expected-head merge of #721. There is currently 1 open Noema pull request, Draft #722; it repairs private-vulnerability-reporting audit authentication and does not alter reviewer evidence-admission authority. Reviewer evidence-admission source from #556 and the producer-specific trusted-research byte-integrity adapter integrated through #607 remain protected ancestry. Later runner, State / Checkpoint, Policy / Approval and documentation work through #721 does not move execution/research producer truth, provider routing, outbound authority, quarantine/security verdicts or foreign-domain truth into Noema reviewer admission.

Noema owns reviewer evidence admission and exact revision/run identity. The protected admission contract binds authenticated producer receipts to independent ClaimEvidenceRequirement publication authority. Raw source context is not finding authority unless a trusted producer authorizes the exact claim/evidence kind and coordinates. Requirement/receipt mismatch, wrong coordinates, paraphrase-to-line substitution, direct model dictionaries, context-to-finding promotion, finding-free model non-approval, stale run identity and unbound replay receipt authority fail closed before publication.

Protected #607 adds only the Noema-side trusted-research-retrieval@v1 byte-integrity adapter. It accepts already-retrieved immutable bytes plus a non-empty exact excerpt present verbatim in those bytes and delegates to the generic research receipt kernel. It does not own network retrieval, source selection, decoding/normalization, Zotero/OA truth, mutable URL authority or provider routing.

Canonical owner prerequisites — fresh 2026-09-18 KST read

.github#2086 — execution framing

ContextualWisdomLab/.github#2086 remains open. Its canonical owner contract still requires exact child stdout/stderr bytes to be separated from one wrapper-authored sandboxed_verify result envelope.

Owner PR #2088 is also still open and currently non-mergeable at exact f111da97bb091330f0eb2e92f08d36eedac771de. Its valid mixed-stream repair is explicitly carried by successor #2109 rather than discarded. Successor #2109 remains open and currently non-mergeable at exact cc6e39f207649c3738a93fe1d6ca1447d090885a over .github main@fb17ef556f94f673234aa557254ae52779e9a7b0.

#2109 is not owner-complete. Fresh PR state no longer supports the older shorthand that all five current hosted workflows are terminal SUCCESS: its own current authority records Security Scan, Runtime Quality, Python Security and SAST as terminal SUCCESS, while CodeQL remains terminal FAILURE after the legacy handler completed both language analyses but wake/settlement failed against the shared running required workflow. That is a central owner lifecycle defect rather than a Noema semantic finding, but it is still non-passing evidence.

A separate valid Runtime Quality admission RED also remains unresolved on #2109: review of .github#2079@9dccfaa0776950498e557390a2fa8d6c34e0baf4 showed that a change to scripts/ci/noema_review_gate.py and its Noema contract test emitted Security/SAST/Python Security/CodeQL but no Agent Review Runtime Quality run. Current #2109 changed-file inventory contains the sandbox/queue admission repair but still does not carry scripts/ci/noema_review_gate.py, tests/test_noema_review_gate.py, or tests/test_noema_review_finding_probe_binding_contract.py as owned changed paths. Keep this finding on the existing #2109 owner lane; Noema must not copy the producer or create a competing central workflow writer.

.github#2087 — trusted research retrieval

ContextualWisdomLab/.github#2087 also remains open. It still requires a canonical versioned trusted-research retrieval handoff with exact captured bytes, immutable/content-addressed revision, exact excerpt bytes and explicit bounded redirect/encoding/cache/retry semantics. Model prose, normalized snippets, mutable URLs, browser/search metadata or a Noema-side adapter cannot impersonate that producer evidence.

Both are owner-side producer prerequisites. Mutable sibling source/PR/package heads are ineligible. Noema may expand accepted producer versions only after the owner contracts are immutable/versioned and the exact producer identity can be independently verified.

End-to-end completion evidence

Keep this issue open. Completion requires:

• immutable/versioned .github#2086 execution framing and .github#2087 trusted-retrieval producer contracts;
• narrow Noema adapter/version wiring against those released producer identities, with hostile substitution/replay tests;
• authenticated execution/research manifests produced on a real central-review consumer path;
• one immutable Noema SemVer release bound to exact source/tag/package-or-image/SBOM/provenance/reproducibility/rollback evidence;
• central consumer bump only to that immutable released Noema contract;
• unchanged original external-evidence corpus rerun RED→GREEN under the released consumer path.

Fresh Noema GitHub Release inventory on 2026-09-18 KST remains 0. Protected source, #607 integration, later documentation/runtime/release-source convergence, PR checks and issue prose therefore cannot be promoted to released-consumer authority. #722's hosted wait is unrelated to these central producer prerequisites. Checks, formal review, authenticated evidence receipts, merge, immutable release, deployment and production KPI remain separate evidence classes.

Do not copy central producer implementations into Noema, consume mutable owner heads, parse attacker-controlled marker-looking output as trusted control data, import foreign outbound/security authority, or weaken receipt requirements to manufacture completion.

Related: #5, #27, #30, #36, #556, #607, #714, #717, #719, #721, #722; ContextualWisdomLab/.github#2086; ContextualWisdomLab/.github#2087; .github#2088; .github#2109.

[seonghobae]

Fresh owner-path update on 2026-09-07 KST: PR #556 is now exact 809aa6d1d0e429a44940f0978ae985c8295beaab on the existing stacked #535 predecessor. During review, the source | execution | research receipt union had canonical producers for execution/research but source evidence was still only hand-assembled in the fixture, leaving the advertised producer-issued three-kind contract asymmetric. Test-only 6fed7a67ea99aa79cd1545846737aa153498fae7 first required a package-root produce_source_claim_receipt; predecessor source deterministically lacks that API. Production dd547c263568bc6b016e20c0cd8a9627748d8d56 adds the source producer by reusing the existing canonical artifact/identity helpers rather than duplicating the manifest/serialization kernel, and 809aa6d... exports it while preserving the concurrently-added authenticated-manifest verification (VerifiedClaimEvidenceIndex, manifest digest/run identity verification). The focused branch report is 44 passing receipt tests with 100% statement/branch/public-doc coverage, but hosted exact-head gates remain the only merge authority. No hosted RED is claimed for the immediately-superseded test-only head. Remaining acceptance is unchanged: adapt the real execution/research producer paths, populate/authenticate the manifest at the actual agent→gate→publish boundary, remove free-text evidence as publication authority as applicable, obtain exact-head CI/Security/SBOM/provenance GREEN, integrate the #536→#535→#556 stack normally, create an immutable Noema release, then let .github#1641 consume that released contract and rerun the original RED corpus.

[seonghobae]

Security-routing follow-up from the same fresh sweep: the live inherited ruleset is 18794436 (CWL Noema central security scan), active with conditions.ref_name.include=["~DEFAULT_BRANCH"], no bypass actors, and required workflow .github/workflows/security-scan.yml@refs/heads/main. That explains why stacked #556 exact 809aa6d..., whose current base is the #535 feature branch, has CI/reviewer/image runs but no Security Scan run. This absence is neither GREEN nor a current routing defect under the actual ruleset condition. The required scan becomes applicable after the dependency stack integrates and #556 is ordinary/non-force restacked/retargeted to protected main; merge remains forbidden until that post-retarget exact head receives terminal-success Security together with the other required evidence. PR #556 body has been corrected to record this live rule instead of treating feature-base absence as an eligible scanner result.

[seonghobae]

Current owner progress after fresh #556 review: exact 2b123ec538bf248d0a388a2b265f41722170026f now adds the missing model-visible receipt-reference port without changing the canonical manifest kernel. Test-only b6b25ce28ca55632ca521cbe28dcdcdeea7bf9ea requires exact <claim> [receipt:<id>] syntax; production ed243aad12b24d9183b9e63ca8c90175512a90c7 parses one canonical trailing marker and delegates exact claim/time/kind admission to the verified manifest index. Test-only 9b4841934e42c821413783f3bf588fe712b95da3 then requires that adapter through the public package port; production 2b123ec... exports only those adapter functions.

The focused regression preserves the original Concept35 sentence and synonym, rejects receipt reuse across different claim bytes, rejects source→execution kind confusion, rejects marker-only sandboxed_verify text without a trusted manifest receipt, malformed/multiple/noncanonical markers, and structured model objects. These are deterministic RED→repair commits; no hosted RED is claimed for the immediately superseded test-only heads.

Fresh exact-head runs are ci 34080213510, reviewer-ci 34080213450, and patch-validator-image 34080213443, currently queued. No Security Scan is expected while #556 remains feature-base stacked under live ruleset 18794436; post-#536/#535 retarget to protected main must create and pass it.

The principal remaining owner gap is now narrower and still real: production central-review.yml publishes Finding.evidence free text and does not yet populate/verify the claim-evidence manifest at the actual agent → gate → publish boundary. Execution/research producer adaptation into that authenticated handoff remains required before release; central .github#1641 should remain RED until it consumes an immutable Noema release.

[seonghobae]

Owner-path update after fresh live review: PR #556 is still an intentionally stacked Draft on #535 and has advanced independently to exact 5121e1e0e445da8f5c80674c42b17d090caaeff4. The source-evidence slice of this issue is now materially implemented rather than merely schema-level: production central-review.yml creates a bounded current-head source receipt manifest, hashes it, attests the review manifest and claim-evidence manifest separately, re-verifies both attestation bundles/digests and exact repository/head/workflow/run/attempt identity before publish, and passes the verified claim-evidence identity into the reviewer CLI. claim_evidence_runtime.py admits model findings only through the immutable verified index, rejects missing/unknown receipts, binds source receipts back to exact Finding.path/Finding.line, and fail-closes unsafe source paths/symlinks/oversize/non-printable inputs. Current #556 review-thread authority is empty. This does not complete the issue: sandboxed_verify still needs a canonical execution producer carrying argv/tool/version/exit/stdout/stderr/isolation/network artifact identity, trusted research retrieval still needs content-addressed revision/excerpt/policy receipts, the stack still requires #536→#535 integration then non-force retarget/restack with required Security, and immutable Noema release + released .github#1641 consumer RED→GREEN remain mandatory. Concurrent #556 commits are being preserved rather than overwritten from other lanes.

[seonghobae]

Fresh owner-path progress: PR #556 is now exact fecb03d9c632f90f290f921c1d6e90ce86ca5305. Test-only f2993810dbd7a862678460c5f14055d6bc932e7b first requires a public trusted sandboxed_verify execution adapter; predecessor source lacks that port, so this is deterministic RED but not hosted RED because it was immediately superseded. Production ea751bc99be9f8035a089e55538886a820a905c0 adds the adapter and fecb03d... exports it.

The adapter does not copy central execution code or create a second manifest kernel. It accepts only reviewed immutable central helper revision c9052e607e5f3cc76e73207e7786b21500721b79, validates the current SANDBOXED_VERIFY_RESULT shape with unknown-field rejection, requires exact command stdout/stderr separately, and delegates canonical receipt/artifact construction to the existing execution receipt producer. Marker-only output therefore remains insufficient authority. Non-empty allowed_env, unreviewed helper revisions, malformed/expanded marker semantics, empty commands, or false sandbox markers fail closed.

Crucially, the receipt does not overstate the current helper: central sandboxed_verify.py copies the workspace and scrubs environment but runs the command as an ordinary subprocess, while --network is declared metadata only. The adapter records workspace-copy+scrubbed-env;os-process-isolation=none and declared:<network>;enforced=false rather than inventing quarantine/network enforcement.

Fresh #556 exact-head runs are ci 34089768682 queued, reviewer-ci 34089768665 pending, and patch-validator-image 34089768733 queued. No Security Scan is expected before post-prerequisite retarget to protected main under ruleset 18794436. Remaining delivery is real consumer capture of exact stdout/stderr into this adapter, trusted research retrieval adaptation, #536→#535→#556 normal integration, immutable Noema release, then released .github#1641 consumption and original hosted RED→GREEN.

[seonghobae]

Fresh owner evidence after protected #548 integration: current protected Noema is main@e6de53a1c2902cddc09e77a58efb82420cd8f5db; central .github/main remains 78a4937c684a54ca8e415822c913742f41c6efc4.

#556 exact fecb03d9c632f90f290f921c1d6e90ce86ca5305 now has a hosted stack-ancestry RED, not a semantic/product RED. CI run 34089768682, job 101640717018, checked out the exact head and failed the live-base guard before lockfile control because the head did not contain then-live #535 base 329069405181921091397d31687f2c5f7a98ae54. Reviewer-ci/image success on that stale head cannot override or transfer across the required restack.

The causal owner path is therefore explicit: ordinary/non-force converge #535 onto current protected #548 ancestry while preserving failed-check/source-evidence behavior and the protected noema-core Shared Kernel; get fresh exact-head gates and normally integrate #535; then live-read and semantic restack/retarget #556 onto the resulting protected main. During that restack, do not carry #556's historical docs/product-technical-gap-baseline.md delta: #547 is the sole cross-lane baseline writer. Only after current-main exact-head required Security/CI/reviewer/image, execution/research producer handoff, immutable Noema release, and a released .github#1641 consumer bump can the original hosted Concept35 corpus be rerun for GREEN.

[seonghobae]

2026-09-07 KST authority refresh: prerequisite #535 has now ordinary/non-force converged to exact 4ad6907ae9f97b202a32a9b5e170f275ac9129b9 on protected main@e6de53a1c2902cddc09e77a58efb82420cd8f5db; fresh compare is ahead-only with behind_by=0 and merge-base exactly protected main. The convergence preserves protected #548 actionable failed-check/source-evidence behavior and #536 Shared Kernel/package truth while retaining only Noema's strict orchestrator/free consumer boundary. Its current exact-head CI/reviewer/Security/image generation is still queued, so #535 is not merge authority yet. Keep #556 fecb03d9c632f90f290f921c1d6e90ce86ca5305 stale/stacked and do not rerun or force-rebase it as a substitute. Executable order is now: unchanged #535 four-GREEN + clean review → normal #535 merge → re-read protected main and live #556 → ordinary/non-force #556 restack/retarget excluding the historical #547-owned baseline blob → fresh applicable gates → immutable Noema release → released .github#1641 consumer bump and original hosted corpus RED→GREEN. Research-receipt producer and execution stdout/stderr byte handoff remain unsatisfied product boundaries.

[seonghobae]

Authority update after normal #547 integration: protected Noema is now GitHub-verified main@699489cdbb8de3404154d9a3d6022c692ce85fd6. Prerequisite #535 was ordinary/non-force converged onto that protected source as exact 6739f0ab58e81dc56ea1485a5dea0f39e1cdfd3a (first parent protected main, second parent prior 977188143...); fresh compare is ahead-only/behind_by=0 and a new four-gate generation is queued/pending, so prior GREEN does not transfer. #556 remains stale exact fecb03d9... on the feature base and must not move until #535 normally integrates. After that: live-read protected source and #556, semantic restack only its valid receipt/evidence delta (omit historical #547-owned baseline blobs), fresh Security 포함 four-gate authority, normal merge, immutable Noema release/SBOM/provenance/repro/rollback, then central .github#1641 released consumer bump and unchanged original Concept35 RED→GREEN.

[seonghobae]

Fresh 2026-09-11 owner-path verification after protected #606 integration: current protected Noema is GitHub-verified main@8a03aabf9c0f2d02d1f17c9848ba9abe88f71753, with 0 open PRs and 0 GitHub Releases at this observation. The protected produce_sandboxed_verify_execution_claim_receipt adapter is present and remains pinned to central helper revision c9052e607e5f3cc76e73207e7786b21500721b79; current central-review.yml still produces/attests only source-claim evidence, so real execution-evidence publication remains open.

The consumer gap is now blocked by a concrete foreign-owner framing defect rather than a missing Noema schema. Exact inspection of .github:scripts/ci/sandboxed_verify.py@c9052e... shows the helper captures child stdout/stderr internally, then forwards child stdout onto the wrapper's stdout and finally prints the wrapper-authored SANDBOXED_VERIFY_RESULT envelope onto that same stdout channel. An untrusted command can therefore emit marker-shaped bytes itself; Noema cannot safely recover an independently trusted command_stdout + marker handoff by heuristically parsing the mixed stream. Doing so would weaken the existing adapter invariant that marker-only output is insufficient authority.

Canonical owner issue ContextualWisdomLab/.github#2086 now requests a versioned machine handoff that separates exact command stdout, exact command stderr and wrapper-authored result/control data, with hostile marker-spoof/binary/size/timeout tests and no overstatement of network/process isolation. Until that owner contract exists immutably, Noema must not copy the central helper, parse final-marker-looking command output as trusted control data, expand _SUPPORTED_POLICIES, or wire a fake execution receipt into central-review.yml.

This blocks only the sandboxed_verify execution-producer consumer sub-lane. Trusted research retrieval, immutable Noema release preparation and other independent Noema-owned gaps remain separately executable.

[seonghobae]

Independent research-evidence owner progress on current protected main@8a03aabf9c0f2d02d1f17c9848ba9abe88f71753: Draft #607 now owns the Noema-local trusted-retrieval adapter gap without inventing retrieval/network authority. Current exact eebcdf9941dfea4b7969d497bb76bf6d56a8652c adds produce_trusted_research_claim_receipt, which accepts already-retrieved immutable bytes, rejects empty/absent/non-byte excerpts, requires the cited excerpt to occur verbatim in the retrieved bytes, hard-codes the reviewed trusted-research-retrieval@v1 identity, and delegates canonical source-revision/excerpt-digest/artifact construction to the existing generic receipt kernel. No decoding, normalization, paraphrase matching, web retrieval or model-selected source is introduced.

This is not yet the complete research producer acceptance: a canonical trusted retrieval producer still has to supply exact retrieved bytes/excerpt/policy into the authenticated manifest at the real agent→gate→publish boundary, followed by exact-head gates, immutable Noema release and released central consumer RED→GREEN. #607 remains Draft; its final exact four hosted generations are currently queued and canonical CHANGELOG/gap-baseline convergence is still a current completion finding. The sandboxed_verify execution sub-lane remains separately routed to .github#2086.

[seonghobae]

2026-09-11 current-authority update:

• Protected Noema has advanced through normal docs(workflow-state): classify protected operability source #606 integration to main@8a03aabf9c0f2d02d1f17c9848ba9abe88f71753; the older main@36e5cf... and historical #559 sole writer wording in the issue body are not current mutation authority.
• Draft fix(reviewer): bind research excerpts to retrieved source bytes #607 now owns the Noema-side trusted-research byte-integrity adapter on exact 0afd68d2e33b7fd9be2307ba78b370b534cc0f54. It requires already-retrieved immutable bytes, a non-empty exact excerpt present verbatim in those bytes, fixes producer identity to trusted-research-retrieval@v1, and delegates canonical receipt construction to the protected generic research kernel. It does not perform retrieval, source selection, decoding/normalization, network policy, Zotero/OA truth, or model source selection.
• Canonical CHANGELOG, docs/product-technical-gap-baseline.md, and an executable documentation-authority regression now distinguish this adapter source from the still-open live trusted retrieval producer, retrieval→manifest wiring, immutable Noema release, and released central consumer. Those evidence classes remain required before feat(reviewer): bind external evidence receipts to exact claims and runs #555 can close.
• sandboxed_verify execution framing remains separately owned by ContextualWisdomLab/.github#2086; Noema will not parse the current mixed child-stdout/control-marker stream heuristically.

#607 remains Draft until the unchanged final exact head receives its own terminal application CI, reviewer-ci, required Security Scan and patch-validator-image GREEN plus a fresh clean current-head review/thread sweep. No predecessor GREEN is transferred.

[seonghobae]

Owner-path follow-up: no existing open .github issue for the trusted research producer was found, so the shared control-plane prerequisite is now tracked at ContextualWisdomLab/.github#2087. It owns only the canonical versioned retrieval/handoff (exact retrieved bytes, immutable/content-addressed revision, verbatim excerpt bytes, bounded retrieval semantics and hostile fixtures). Noema #555 remains the receipt admission/consumer owner; .github#2086 remains the separate execution framing owner. Do not consume #2087 mutable source from Noema.

[seonghobae]

Protected integration update: #607 exact 0afd68d2e33b7fd9be2307ba78b370b534cc0f54 earned terminal SUCCESS on application CI 34553507969, reviewer-ci 34553507948, required Security Scan 34553507940, and patch-validator-image 34553507986, then normal-merged without squash/rebase. Protected main is now GitHub-verified merge b3e940e4c0fb317ce50d34458bf8f2958f428cd7 with parents previous protected 8a03aabf9c0f2d02d1f17c9848ba9abe88f71753 and exact #607 head 0afd68d2e33b7fd9be2307ba78b370b534cc0f54.

The Noema-side trusted-research-retrieval@v1 byte-integrity adapter is therefore protected source. #555 remains open: live retrieval producer/handoff is .github#2087, execution framing is .github#2086, and immutable Noema release + released central consumer remain separate completion evidence. Do not consume mutable .github owner source.