fix(trust): rebind audited central workflow source

[seonghobae]

Scope

Bind Noema GitHub Actions OIDC workflow-source authority to the freshly audited protected ContextualWisdomLab/.github/main commit without weakening exact job_workflow_sha equality, changing Durable Object lifecycle state, or copying central workflow/security/provider authority into Noema.

Current central roll-forward — 2026-09-06 KST

Protected .github/main is 43024633eba9d96b0456970391360da5a171fbda. The latest central delta is #1953, a Strix-owned sandbox-bootstrap retry/verdict repair. It does not transfer Strix retry, provider/model routing, sanitizer, security/quarantine, or outbound authority into Noema.

OIDC job_workflow_sha authenticates the complete protected central source commit rather than an individual reusable-workflow blob, so the predecessor fb2ae81... pin became stale when central main advanced.

• RED beb196bf5c1500b5a49d949553c01091c0a93a52 changes only test/trusted-workflow-source-rollforward.test.ts to require 43024633... while production still held the predecessor pin.
• Production ec5b105161ec1f3a9241c3098eae7986542aabb2 changes only ALLOWED_WORKFLOW_SHA to 43024633....
• Ordinary two-parent/non-force restack d289bfcdb617249c90f9fcc1ba050a59334d07fd preserves the branch-owned trust/documentation/test delta and adopts protected Noema main@5b8e620dbb01a794c1a38535bbcc32e41a80d0df including docs(agents): add cross-session coordination know-how #552 cross-session coordination guidance. No history rewrite or force push was used.

Current exact authority

• protected Noema base: main@5b8e620dbb01a794c1a38535bbcc32e41a80d0df;
• audited central owner: .github/main@43024633eba9d96b0456970391360da5a171fbda;
• exact PR head: d289bfcdb617249c90f9fcc1ba050a59334d07fd;
• lifecycle: open / Draft;
• fresh exact-head workflows: Security Scan 34020897117 queued, reviewer-ci 34020897121 queued, patch-validator-image 34020897120 pending, ci 34020897118 pending. Predecessor results do not transfer.

Keep Draft until the unchanged exact head has terminal current CI/reviewer/Security/image evidence and current review state is clear. Do not self-approve, rewrite history, weaken OIDC equality, or make Noema a second owner of central workflow/provider/security policy.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

중앙 워크플로의 감사 SHA를 33db5bf40672f6292e9f0965d977e3b0d293df90으로 갱신했습니다. wrangler.toml을 정식 SHA 사본으로 지정했습니다. 문서 계약과 Durable Objects의 기존 SQLite 상태 선언 검사를 갱신했습니다.

Changes

워크플로 신뢰 계약 갱신

Layer / File(s)	Summary
감사된 워크플로 SHA 갱신 wrangler.toml, test/trusted-workflow-source-rollforward.test.ts	ALLOWED_WORKFLOW_SHA와 감사된 중앙 워크플로 소스 SHA를 33db5bf40672f6292e9f0965d977e3b0d293df90으로 갱신했습니다.
신뢰 계약 및 상태 보존 검증 ARCHITECTURE.md, test/architecture-documentation.test.ts, test/trusted-workflow-runtime-state-preservation.test.ts	wrangler.toml을 SHA의 정식 사본으로 명시하고 문서의 SHA 중복 검증을 변경했습니다. NoemaRateLimiter와 NoemaOidcReplayGuard의 SQLite 상태 선언을 검증하고 new_sqlite_classes 마커를 거부하는 테스트를 추가했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 46b08

The PR rebinds the trusted workflow source to the current protected commit while preserving strict identity and exact source verification. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 감사된 중앙 워크플로 소스에 대한 신뢰 바인딩 변경을 정확히 요약하며, PR의 주요 변경 사항과 일치합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/trusted-workflow-source-rollforward-71abbd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.