feat(reviewer): bind external evidence receipts to exact claims and runs

[seonghobae]

Problem

Central ContextualWisdomLab/.github#1641 has an exact hosted false-negative reproducer for unreceipted external tool-behavior claims. Consumer RED head b8c986e2406beb37d254acd4c5df6389038b55f2, run 34073137064, job 101594104816, failed only the original two provenance regressions: 2 failed, 2974 passed, 1 skipped, 21 subtests passed, with DID NOT RAISE NoemaModelOutputError.

Noema owns reviewer evidence admission and exact revision/run identity. Central .github is the consumer. Provider/model routing remains owned by contextual-orchestrator; source, execution and research receipts are distinct authority classes. Quarantine/security/outbound verdicts remain with their canonical owners.

Current implementation / stack authority — 2026-09-08 KST

Protected Noema is GitHub-verified main@099d7d89a51bca4a2cf7c6b285b50ffadd08d001 after normal #540 integration.

Implementation owner is PR #556 exact fecb03d9c632f90f290f921c1d6e90ce86ca5305, still Draft on feature base fix/noema-orchestrator-free-routing-alias. Its live prerequisite #535 has advanced non-force to exact 2ab3fb4da9433701f1c806b8339054f581e8278f. That #535 commit is an ordinary two-parent convergence [099d7d89..., e996b509...]; fresh compare is ahead-only, behind_by=0, with merge-base exactly protected main. It carries the 31 non-overlapping gateway/reviewer owner-contract paths while preserving the six protected hourly-workflow overlap paths. The remaining orchestrator/free source-pin and proposer-timeout mismatch is therefore deterministic source RED rather than stale ancestry RED. Fresh #535 CI/reviewer/Security/image runs are new and non-authorizing until terminal success after the causal overlap repair.

#547 remains the independent sole writer for docs/product-technical-gap-baseline.md and its documentation-authority contracts. Current exact is 30b7e7e5cdab8de65715834a16f994b2047eafa6; application CI, reviewer-ci and required Security are terminal success, while patch-validator-image 34165467851 remains in progress at the exact image-build lane. Its baseline blob must not be carried through #556.

Integration order

1. docs: reconcile protected runtime and commercial gap authority #547 may normally integrate only after unchanged exact 30b7e7e... obtains terminal-success image evidence, fresh behind_by=0, and clean review authority.
2. Finish fix: pin NOEMA_LLM_MODEL routing alias to orchestrator/free #535's six-path protected-first causal repair: preserve fix(toolchain): replace Wrangler/Miniflare GPL-family path #540 work-conserving/central-dispatch behavior, pin NOEMA_LLM_MODEL: orchestrator/free, remove the repository-authored proposer wall-clock timeout, and align the operations/executable authority contracts. Require wholly fresh exact-head CI, reviewer-ci, required Security and patch-validator-image GREEN; normal merge only.
3. Re-read protected main and live feat(reviewer): bind evidence receipts to exact claims #556. Restack/retarget feat(reviewer): bind evidence receipts to exact claims #556 non-force from protected source, carry only its valid evidence-receipt delta, and drop the historical docs: reconcile protected runtime and commercial gap authority #547-owned baseline delta.
4. Require wholly fresh exact-head CI/reviewer/required Security/patch-validator-image terminal success and clean review authority; normal merge only.
5. Publish and verify one immutable Noema SemVer release bound to exact protected source/tag/package/SBOM/provenance/reproducibility/rollback evidence.
6. Bump central .github#1641 to that released Noema contract and rerun the unchanged original Concept35 corpus RED→GREEN. Mutable or unreleased dependency consumption is forbidden.

Hosted stale-stack RED retained as evidence

#556 run 34089768682, job 101640717018, checked out exact fecb03d9c632f90f290f921c1d6e90ce86ca5305, passed checkout/toolchain setup, then failed the live-base guard before lockfile control. Reviewer-ci 34089768665 and patch-validator-image 34089768733 succeeded on that stale exact head; no Security Scan exists. Under current AGENTS, absent required Security is non-passing. Do not rerun this invalid stack merely to manufacture another check.

Implemented #556 source contract retained for later semantic restack

The candidate binds trusted producer evidence to exact claims through canonical receipt ID/evidence kind, exact repository/head/workflow/run/attempt, claim/evidence digests, evidence-kind separation, trusted manifest/index admission and model-visible [receipt:<id>] references before deterministic gates/publication. Source receipts cannot authorize execution or research facts.

A public trusted sandboxed_verify execution adapter is exported on the candidate. It accepts only reviewed immutable central helper revision c9052e607e5f3cc76e73207e7786b21500721b79, validates the marker schema with extra=forbid, requires exact captured stdout/stderr separately, and rejects unreviewed helper revisions, non-empty allowed_env, malformed markers, empty commands and false sandbox markers.

Remaining product boundary: the central sandboxed_verify.py marker still does not contain exact stdout/stderr bytes, so a released consumer must capture those streams out of band and pass them to the versioned Noema adapter; trusted research retrieval still needs a content-addressed revision/excerpt/retrieval-policy producer; malformed/stale/wrong-head/wrong-run/wrong-claim/wrong-kind/digest-mismatched receipts remain fail closed; immutable release and consumer GREEN cannot be inferred from candidate source.

Keep this issue open. #547 image evidence, #535 overlap repair/exact-head gates, #556 restack/Security, immutable release and released-consumer verification remain incomplete.

[seonghobae]

Fresh owner-path update on 2026-09-07 KST: PR #556 is now exact 809aa6d1d0e429a44940f0978ae985c8295beaab on the existing stacked #535 predecessor. During review, the source | execution | research receipt union had canonical producers for execution/research but source evidence was still only hand-assembled in the fixture, leaving the advertised producer-issued three-kind contract asymmetric. Test-only 6fed7a67ea99aa79cd1545846737aa153498fae7 first required a package-root produce_source_claim_receipt; predecessor source deterministically lacks that API. Production dd547c263568bc6b016e20c0cd8a9627748d8d56 adds the source producer by reusing the existing canonical artifact/identity helpers rather than duplicating the manifest/serialization kernel, and 809aa6d... exports it while preserving the concurrently-added authenticated-manifest verification (VerifiedClaimEvidenceIndex, manifest digest/run identity verification). The focused branch report is 44 passing receipt tests with 100% statement/branch/public-doc coverage, but hosted exact-head gates remain the only merge authority. No hosted RED is claimed for the immediately-superseded test-only head. Remaining acceptance is unchanged: adapt the real execution/research producer paths, populate/authenticate the manifest at the actual agent→gate→publish boundary, remove free-text evidence as publication authority as applicable, obtain exact-head CI/Security/SBOM/provenance GREEN, integrate the #536→#535→#556 stack normally, create an immutable Noema release, then let .github#1641 consume that released contract and rerun the original RED corpus.

[seonghobae]

Security-routing follow-up from the same fresh sweep: the live inherited ruleset is 18794436 (CWL Noema central security scan), active with conditions.ref_name.include=["~DEFAULT_BRANCH"], no bypass actors, and required workflow .github/workflows/security-scan.yml@refs/heads/main. That explains why stacked #556 exact 809aa6d..., whose current base is the #535 feature branch, has CI/reviewer/image runs but no Security Scan run. This absence is neither GREEN nor a current routing defect under the actual ruleset condition. The required scan becomes applicable after the dependency stack integrates and #556 is ordinary/non-force restacked/retargeted to protected main; merge remains forbidden until that post-retarget exact head receives terminal-success Security together with the other required evidence. PR #556 body has been corrected to record this live rule instead of treating feature-base absence as an eligible scanner result.

[seonghobae]

Current owner progress after fresh #556 review: exact 2b123ec538bf248d0a388a2b265f41722170026f now adds the missing model-visible receipt-reference port without changing the canonical manifest kernel. Test-only b6b25ce28ca55632ca521cbe28dcdcdeea7bf9ea requires exact <claim> [receipt:<id>] syntax; production ed243aad12b24d9183b9e63ca8c90175512a90c7 parses one canonical trailing marker and delegates exact claim/time/kind admission to the verified manifest index. Test-only 9b4841934e42c821413783f3bf588fe712b95da3 then requires that adapter through the public package port; production 2b123ec... exports only those adapter functions.

The focused regression preserves the original Concept35 sentence and synonym, rejects receipt reuse across different claim bytes, rejects source→execution kind confusion, rejects marker-only sandboxed_verify text without a trusted manifest receipt, malformed/multiple/noncanonical markers, and structured model objects. These are deterministic RED→repair commits; no hosted RED is claimed for the immediately superseded test-only heads.

Fresh exact-head runs are ci 34080213510, reviewer-ci 34080213450, and patch-validator-image 34080213443, currently queued. No Security Scan is expected while #556 remains feature-base stacked under live ruleset 18794436; post-#536/#535 retarget to protected main must create and pass it.

The principal remaining owner gap is now narrower and still real: production central-review.yml publishes Finding.evidence free text and does not yet populate/verify the claim-evidence manifest at the actual agent → gate → publish boundary. Execution/research producer adaptation into that authenticated handoff remains required before release; central .github#1641 should remain RED until it consumes an immutable Noema release.

[seonghobae]

Owner-path update after fresh live review: PR #556 is still an intentionally stacked Draft on #535 and has advanced independently to exact 5121e1e0e445da8f5c80674c42b17d090caaeff4. The source-evidence slice of this issue is now materially implemented rather than merely schema-level: production central-review.yml creates a bounded current-head source receipt manifest, hashes it, attests the review manifest and claim-evidence manifest separately, re-verifies both attestation bundles/digests and exact repository/head/workflow/run/attempt identity before publish, and passes the verified claim-evidence identity into the reviewer CLI. claim_evidence_runtime.py admits model findings only through the immutable verified index, rejects missing/unknown receipts, binds source receipts back to exact Finding.path/Finding.line, and fail-closes unsafe source paths/symlinks/oversize/non-printable inputs. Current #556 review-thread authority is empty. This does not complete the issue: sandboxed_verify still needs a canonical execution producer carrying argv/tool/version/exit/stdout/stderr/isolation/network artifact identity, trusted research retrieval still needs content-addressed revision/excerpt/policy receipts, the stack still requires #536→#535 integration then non-force retarget/restack with required Security, and immutable Noema release + released .github#1641 consumer RED→GREEN remain mandatory. Concurrent #556 commits are being preserved rather than overwritten from other lanes.

[seonghobae]

Fresh owner-path progress: PR #556 is now exact fecb03d9c632f90f290f921c1d6e90ce86ca5305. Test-only f2993810dbd7a862678460c5f14055d6bc932e7b first requires a public trusted sandboxed_verify execution adapter; predecessor source lacks that port, so this is deterministic RED but not hosted RED because it was immediately superseded. Production ea751bc99be9f8035a089e55538886a820a905c0 adds the adapter and fecb03d... exports it.

The adapter does not copy central execution code or create a second manifest kernel. It accepts only reviewed immutable central helper revision c9052e607e5f3cc76e73207e7786b21500721b79, validates the current SANDBOXED_VERIFY_RESULT shape with unknown-field rejection, requires exact command stdout/stderr separately, and delegates canonical receipt/artifact construction to the existing execution receipt producer. Marker-only output therefore remains insufficient authority. Non-empty allowed_env, unreviewed helper revisions, malformed/expanded marker semantics, empty commands, or false sandbox markers fail closed.

Crucially, the receipt does not overstate the current helper: central sandboxed_verify.py copies the workspace and scrubs environment but runs the command as an ordinary subprocess, while --network is declared metadata only. The adapter records workspace-copy+scrubbed-env;os-process-isolation=none and declared:<network>;enforced=false rather than inventing quarantine/network enforcement.

Fresh #556 exact-head runs are ci 34089768682 queued, reviewer-ci 34089768665 pending, and patch-validator-image 34089768733 queued. No Security Scan is expected before post-prerequisite retarget to protected main under ruleset 18794436. Remaining delivery is real consumer capture of exact stdout/stderr into this adapter, trusted research retrieval adaptation, #536→#535→#556 normal integration, immutable Noema release, then released .github#1641 consumption and original hosted RED→GREEN.

[seonghobae]

Fresh owner evidence after protected #548 integration: current protected Noema is main@e6de53a1c2902cddc09e77a58efb82420cd8f5db; central .github/main remains 78a4937c684a54ca8e415822c913742f41c6efc4.

#556 exact fecb03d9c632f90f290f921c1d6e90ce86ca5305 now has a hosted stack-ancestry RED, not a semantic/product RED. CI run 34089768682, job 101640717018, checked out the exact head and failed the live-base guard before lockfile control because the head did not contain then-live #535 base 329069405181921091397d31687f2c5f7a98ae54. Reviewer-ci/image success on that stale head cannot override or transfer across the required restack.

The causal owner path is therefore explicit: ordinary/non-force converge #535 onto current protected #548 ancestry while preserving failed-check/source-evidence behavior and the protected noema-core Shared Kernel; get fresh exact-head gates and normally integrate #535; then live-read and semantic restack/retarget #556 onto the resulting protected main. During that restack, do not carry #556's historical docs/product-technical-gap-baseline.md delta: #547 is the sole cross-lane baseline writer. Only after current-main exact-head required Security/CI/reviewer/image, execution/research producer handoff, immutable Noema release, and a released .github#1641 consumer bump can the original hosted Concept35 corpus be rerun for GREEN.

[seonghobae]

2026-09-07 KST authority refresh: prerequisite #535 has now ordinary/non-force converged to exact 4ad6907ae9f97b202a32a9b5e170f275ac9129b9 on protected main@e6de53a1c2902cddc09e77a58efb82420cd8f5db; fresh compare is ahead-only with behind_by=0 and merge-base exactly protected main. The convergence preserves protected #548 actionable failed-check/source-evidence behavior and #536 Shared Kernel/package truth while retaining only Noema's strict orchestrator/free consumer boundary. Its current exact-head CI/reviewer/Security/image generation is still queued, so #535 is not merge authority yet. Keep #556 fecb03d9c632f90f290f921c1d6e90ce86ca5305 stale/stacked and do not rerun or force-rebase it as a substitute. Executable order is now: unchanged #535 four-GREEN + clean review → normal #535 merge → re-read protected main and live #556 → ordinary/non-force #556 restack/retarget excluding the historical #547-owned baseline blob → fresh applicable gates → immutable Noema release → released .github#1641 consumer bump and original hosted corpus RED→GREEN. Research-receipt producer and execution stdout/stderr byte handoff remain unsatisfied product boundaries.