docs: define Global Owner-Hosted Runtime V1 architecture

[DanielJD1216]

Summary

• accept ADR 0002 for the single-tenant Global Owner-Hosted Runtime V1 architecture
• bind authorization to server-derived principal, client, workspace/channel, session, credential audience, monotonic authorization/deletion epochs, and an immutable multi-hop destination chain
• keep PostgreSQL 16 as the mandatory MemoryStore/policy core and sole grant authority
• make PostgreSQL 18 plus the isolated model service conditional on optional evidence mode
• define release-time reauthorization, synchronous independent revocation/deletion journal, RPO/RTO targets, and fail-closed restore reconciliation
• define destination-aware evidence release for public, internal, confidential, and restricted evidence
• bind one-use hydration handles to principal, client, session, epochs, destination, audience chain, lifecycle, version, and digest
• preserve stable citation receipt IDs for attribution and candidate provenance
• define credential custody, key rollover, replay state, and database-compromise boundaries
• define cross-UID plus instance-bound model IPC with a boot epoch and one-use nonce
• define structured untrusted-source taint and access-plane mutation mediation for indirect prompt injection
• define an additive future knowledge-provider.query-features.v1 descriptor before optional filters are advertised
• contract the four-tool product direction, including exact fetch and evidence-backed candidate proposal
• separate Gate B entry, Gate B exit, and Gate C pilot approval
• add a 62-scenario synthetic acceptance matrix
• add semantic architecture, mutation, and exact changed-path gates to CI
• keep Gates B through F blocked

Closes #286

Scope

Architecture and governance only.

Changed paths are restricted by the Gate A allowlist to 15 documentation, package-script, and read-only governance-check files.

This PR does not add or authorize:

• remote API or MCP runtime code
• authentication implementation
• database migrations or connections
• model-service implementation changes
• deployment or infrastructure configuration
• credentials or cloud resources
• live connectors or private evidence
• production or team activation
• managed hosting
• package version, dependency, lockfile, tag, release, or publishing changes
• automatic trusted-memory promotion

Architecture decisions

Identity and destination

Effective authorization is the intersection of authenticated human, client, verified workspace/channel context, active session, credential audience, owner/tenant, namespace, capability, immutable destination tuple, complete audience chain, and the release ceiling for every hop.

Tool/model payloads cannot grant or substitute identity, scope, destination, audience, or epoch state.

Bearer-only access tokens are rejected. Interactive/public clients use DPoP; confidential/workload clients use mTLS token binding, so a copied token without its bound key or certificate fails before policy evaluation.

Data and revocation

• PostgreSQL 16 is mandatory and is the sole grant authority.
• Memory-only operation remains valid without a KnowledgeProvider.
• PostgreSQL 18 and the model service are required only in evidence mode.
• Provider-local ACL metadata may narrow, never widen, Source Wire policy.
• Exact fetch reauthorizes after retrieval and before the durable release receipt.
• Revocation/deletion acknowledgements require a synchronous encrypted journal restored independently from base backups.

Architecture recovery targets:

• PostgreSQL 16: RPO <= 5 minutes, RTO <= 1 hour
• PostgreSQL 18: RPO <= 15 minutes, RTO <= 4 hours
• active revocation/deletion authority: RPO 0
• combined evidence service: RTO <= 4 hours, fail closed until reconciliation

Evidence, citations, and prompt safety

• Evidence crosses the provider boundary as structured instructionAuthority: none, contentTaint: untrusted_source data.
• Evidence cannot mint identity, destination, routing, tool arguments, or mutation authority.
• Evidence-influenced mutations require an access-plane approval authorization bound to principal, client, destination, operation, and canonical argument digest.
• Hydration handles are random, short-lived, one-use, non-transferable capabilities.
• Stable citation receipt IDs provide attribution without becoming permanent evidence capabilities.

Approval ladder

• Gate A: architecture definition only, this PR
• Gate B entry: separately approve synthetic-only implementation after reviewed slices, threat model, dependency review, and tests-first/mutation plans
• Gate B exit: all 62 synthetic implementation acceptance scenarios pass
• Gate C: separately approve operation of the completed synthetic runtime as a pilot
• Gates D through F: low-risk data, private production, and team access remain separately blocked

Verification

Passed on the final staged tree:

• npm run runtime:global-owner-hosted-v1-architecture
• npm run runtime:global-owner-hosted-v1-architecture:smoke
• npm run runtime:global-owner-hosted-v1-architecture:scope
• npm run runtime:threat-model
• npm run runtime:api-contract
• npm run runtime:mcp-contract
• npm run runtime:database-posture
• npm run runtime:deployment-boundary
• npm run docs:command-setup
• npm run docs:links
• npm run docs:anchors
• npm run safety:scan
• npm run claims:scan
• git diff --cached --check

The architecture mutation smoke proves rejection of:

• contradictory client/model authority
• a missing acceptance row
• a wrong gate assignment
• a forbidden runtime path
• a forbidden deployment path
• deployment-approval drift

Full npm run ci:check and npm run publish:readiness passed on the final staged tree.

Security and privacy review

The first independent review blocked the draft on destination binding, cross-store revocation, citation replay, credential custody, prompt injection, optional provider consistency, stale same-UID IPC, Gate B/C semantics, and tautological verification.

This revision resolves those findings. Final independent second-pass security, consistency, and verification verdicts are required before merge.

Public scans report zero findings. No credentials, private data, private paths, or production artifacts are included.

npm audit --audit-level=high passes. The repository retains two pre-existing moderate advisories in @modelcontextprotocol/sdk / @hono/node-server; this PR changes no dependencies or lockfile.

Rollback

Revert this documentation/governance commit. No runtime, database, deployment, credential, connector, or private-data rollback is required because none is introduced.