[ACP-REVIEW-400] Record parallel assurance review and recovery boundaries

[ootakazuhiko]

Summary

Implements the documentation deliverable in #3675 under #3655.

Adds one dated source-linked review report:
docs/reports/AE-PARALLEL-REVIEW-2026-09.md.

Inspected baseline: c5da6115638fdbfeebbc458b39fa6916db66afb0.
Review commit: 99fbefa20f094dc472baa1b7daa88ed70929a975.

This is a documentation-only review/proposal, not an implementation of its follow-up contracts, human approval, risk waiver or a new mandatory merge gate.

Findings and routing

• [ACP-REVIEW-410] Authority consumerの対象bindingとCheckRun/WorkflowRun IDを明確化する #3676: trusted task subject binding for authority consumers, explicit CheckRun/WorkflowRun identity, bounded input validation and freshness separation.
• [ACP-REVIEW-420] Scoped acceptance planとbounded CI observationで待機・失敗・取得不能を分離する #3677: scoped acceptance plans, read-only bounded CI observation, pending/error/failure distinction and non-circular recovery sequencing.
• Existing [ACP-HARDEN-130] execution-result/v1を導入しstatus非変換を保証する #3658: execution-attempt/process-start/target-check semantics before status migration.
• Existing [ACP-HARDEN-250] review-disposition/v1とhead-bound review completenessを追加する #3661: whole-diff baseline review, delta convergence and evidence-based disposition without suppressing new findings.
• Existing [ACP-HARDEN-260] GitHub Actions supply-chain policyをfull-SHA基準で強化する #3664: unique required-context mapping, staged check-name migration and repository-wide concurrency inventory.
• Existing [ACP-HARDEN-140] Solo maintainer + AI-assisted governance profileを追加する #3667: declared solo profile / canonical policy / live protection alignment and non-circular decision material.

Parallel ownership

No source or metadata in PR #3674 or PR #3673 was changed by this work. No changes to their readiness, reviews, labels, workflow dispatches or branches. This PR adds a new report path only and does not change #3672 acceptance or start #3658. Follow-up Issues are explicitly not new blockers for the active recovery.

Acceptance

• Dated source review separates facts, design recommendations and unexecuted validation.
• Exact inspected source SHA is recorded.
• New follow-ups are scoped; existing topics are routed to their existing Issues.
• Recovery sequence separates own-scope evidence from aggregate security health without authorizing a bypass.
• Documentation-only diff; no workflow, dependency, Schema, source or branch-protection changes.
• Repository CI / documentation policy verification to be observed on this exact PR head; not preclaimed as successful.

Verification

Local checks performed on bytes verified identical to the GitHub blob 95fbc99eb651cd020b83d6b803e79668f6b772d9:

• UTF-8 and YAML front matter: pass
• Markdown parse, one H1 and heading hierarchy: pass
• 14 reference definitions; unresolved reference links: 0
• trailing-whitespace and final-newline checks: pass
• document size: 14,854 bytes / 257 lines

The isolated review environment has no repository checkout or pnpm installation. Full repository tests, pnpm -s run check:schemas, check:doc-consistency and verify:lite were not run locally. No dependency audit, hosted runtime reproduction or production test is claimed. Local link-definition validation is not a network availability test.

Context Pack conflict

None identified for this documentation-only addition. Read docs/spec/context-pack.md and the inventory/reservation Boundary Map; no design objects, morphisms, diagrams or acceptance tests are modified. This is not a claim that the example Boundary Map covers every execution-plane owner.

Risk and compatibility

Documentation-only risk; no change to public API, claim statuses, security thresholds, CI enforcement, approval topology, releases or package publication. Canonical policy remains authoritative. New proposals remain preview/report-only-first unless explicitly adopted later.

Rollback

Revert the single documentation commit or close this Draft PR; follow-up Issue history remains explicit. No data migration or runtime rollback is needed.

Human boundary

Do not auto-merge, Ready, close recovery Issues or mutate branch protection from this PR. The maintainer chooses when to integrate this report. It does not block the currently executing Codex task.

[github-actions]

Generate Artifacts Preview

Generated at: 2026-09-06T20:55:06.740Z

• tests/api/generated: clean
• artifacts/codex: clean
• artifacts/spec: clean

[github-actions]

KvOnce Trace Validation

• OTLP: ✅ Success (Issues: 0)
• NDJSON: ✅ Success (Issues: 0)