feat(analysis): bind independent TDT link-criterion fitting to an analysis-run profile

[seonghobae]

Consolidation status

lineage_criterion_v1 is a Draft Analysis Run fold child, not an independent landing authority. Current exact head is 2b666d94df1454157700dafe5edf5448de28d9e0 on protected main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0.

The surviving Analysis Run vehicle is #416 at 03f8de2ed0a0fb842d2022d411814e440df7cfb4. Fresh comparison is diverged with protected main as merge base: this child has 14 unique commits and #416 has 81. Preserve the unique source/tests/ADR/doctoring/traceability delta through an ordinary conflict-resolving non-force fold; do not close this child until successor inheritance is verified.

Scientific and temporal boundary

Protected main already owns analysis_engine::fit_lineage_criterion_posteriors; this PR does not reimplement Jeffreys fitting. It adds the request/receipt/cutoff application boundary needed to expose that fitter as lineage_criterion_v1.

The original branch was not actually cutoff-safe. Four review findings were valid: observations lacked availability provenance, equivalent RFC 3339 cutoffs were compared textually, malformed event-time strings reached the fitter, and pair/draw work was unbounded before posterior materialization.

Current repair lineage:

• RED f475a312dde77aa3c316b5249f3eb2b0b036835b proves equivalent RFC 3339 spellings must bind the same cutoff instant and malformed predecessor/successor draw timestamps must fail closed. Repair a33ee6807ab843b11d085a28b365fd08b7948810 uses KnowledgeCutoff::instant() and typed EventTime parsing, and separates terminal provider validation (validated) from the artifact domain claim.
• RED 8f4523cf33f75c99a7f3d827745f5580d5139b69 adds explicit per-pair snapshot/availability provenance, historical replay invariance, cross-snapshot/alignment refusal, and resource-budget contracts. Repair e6de3aad0ded19eeefeb67a7f9dc1795025d3b1b censors same-snapshot future-unavailable observations before event-time/scientific admission, rejects cross-snapshot rows, bounds raw pair cardinality, and bounds admitted pair × draw materialization. 55edf20de86ac42540c294ad333d20d8cc4d045e promotes canonical corpus_split::cutoff_eligible to a runtime dependency.
• Repair 01ce4979e1c19702a188dd96e2f3bb2f81e6f5be closes the remaining pre-fit temporal/resource gap: draw-count budget is rejected before observation scanning; visible draw vectors must match the requested count before timestamp parsing; every predecessor/successor draw pair is typed and must preserve predecessor ≤ successor event-time order, matching the protected-main producer contract; admitted pair × draw budget is enforced incrementally before parsing/fitting.
• ADR a500e4eb6ccebd212f91c6d6d9edf1f274fa1a2f and doctoring 2b666d94df1454157700dafe5edf5448de28d9e0 make those exact contracts code-current. ADR 0063 is Proposed, not Accepted.
• The 256 KiB from_json cap remains an untrusted-input boundary. A maximal-valid escaping test proves canonical output stays below the cap, replacing the formerly unreachable post-validation egress branch rather than manufacturing a coverage fixture.

Historical replay invariant: within the raw operational input bound, evidence whose pair-level AvailableTime is after the requested cutoff cannot affect scientific admission, event-time validation, artifact counts, or terminal scientific result. Cross-snapshot provenance remains a hard error rather than historical censoring.

Event-time draws, evidence availability, and the knowledge cutoff remain distinct clocks. Pair-level availability means the complete pair observation became usable as evidence and must not precede either endpoint's availability; it is not inferred from event-time draws or record order.

Claim boundary

Artifact inference status remains independent_tdt_criterion_not_date_from_record_order. AnalysisResultSummary.validation_status is provider-authored status and is exactly validated on success. Raw posterior values and pair identities remain with the scientific fitter.

This slice is not method effects, case deletion, corpus-background refusal, template/copy/style/modality identity, a Bayesian sampler, GPU execution, or topic birth/split/merge.

ADR / docs authority

The branch ADR and doctoring are current to the implementation. Shared docs/adr/README.md, docs/TRACEABILITY.md, and docs/product-technical-gap-baseline.md remain #435 single-writer consolidation surfaces. The shared ADR index must not advertise ADR 0063 as Accepted before protected merge. PR comments/body text do not count as checked-in docs completion.

Review and merge gate

All four original inline review findings were answered with exact repair lineage and resolved. Submitted reviews are COMMENTED only; there is no qualifying current-head APPROVE.

Live organization ruleset 18156473 requires one qualifying current-head approval, dismisses stale approvals on push, requires all review threads resolved, and requires central workflows. The former body text claiming two approvals was stale and has been removed. No self-approval or admin bypass is used.

Exact-head workflows for 2b666d94df1454157700dafe5edf5448de28d9e0 are freshly admitted: Rust Foundation CI 34798603239, Documentation Quality 34798603230, Security Scan 34798603229, SAST Semgrep 34798603174, and CodeQL PR 34798603164; at the latest read they are queued/pending. This body therefore does not claim GREEN, 100% coverage, Ready, or merge readiness. Predecessor checks/reviews do not transfer.

Verification

• cargo fmt --all -- --check
• cargo test -p analysis_engine
• cargo clippy -p analysis_engine --all-targets -- -D warnings
• python3 scripts/validate_documentation.py

Do not force-push, destructively rebase, self-approve, weaken required checks, suppress scanners, use skip/xfail or coverage-denominator tricks, or close this child before verified successor inheritance.

---

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Author COMMENT on exact head 1628f1f. This is not APPROVE. Independent = non-author, non-bot APPROVE. Two independent current-head APPROVEs required before merge. ADR 0063 after #422 took 0062. Do not self-approve.

[devin-ai-integration]

Devin Review found 4 potential issues.

[seonghobae]

Restack on protected main (a243f18)

Non-force merge of origin/main (merge commit 22cebe12); the only conflict was the CHANGELOG.md append, both entries kept. ADR 0063 already carries an admitted maturity value (active-PR).

Local evidence on the pushed head (toolchain 1.98.0): cargo test -p analysis_engine 38 passed / 0 failed, cargo clippy -p analysis_engine --all-targets -D warnings clean, cargo fmt --all --check clean, documentation/workspace/docstring contracts PASS, git diff --check clean.

🤖 Generated with Claude Code