feat(analysis): bind provenance-is-not-transition refusals to an analysis-run profile

[seonghobae]

Consolidation status

fold_child for the Validation / Analysis Run landing vehicle #416. citation_edge_v1 / tepp.citation_edge.v1 is a refusal/census profile over protected-main citation_edge domain truth, not an independent bounded context or protected-main landing authority.

Current exact child head: 1e6b3859b771062da3d164aa2f6f183e2d77549b. Protected base: main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0. Current #416 head: 03f8de2ed0a0fb842d2022d411814e440df7cfb4. Fresh comparison is diverged with protected main as merge base: this child has 13 unique commits and is 81 #416 commits behind. Keep Draft and preserve every valid unique source/test/ADR/doctoring delta until an ordinary non-force conflict-resolving fold verifies inheritance. Simple Close is not consolidation.

Scientific / temporal repair

The original branch called the profile cutoff-safe while CitationEdgeDocument carried only document_id and ProvenanceKind. The executor therefore could not prove row availability or source snapshot, admitted future rows into historical duplicate/domain/counting logic, compared RFC 3339 cutoff strings rather than instants, had no raw MAX_EVIDENCE_UNITS guard before identity allocation, counted the raw slice rather than the admitted census, and reused the domain inference claim as terminal provider validation status.

Repair lineage:

• RED 74d6ea13c211e3218bb4f61654f53a5b44badeb7: equivalent RFC 3339 spellings of one cutoff instant must bind identically; terminal provider validation must remain separate from the domain inference claim.
• Causal repair 3aac0968af752dee7b12ce542b8c73c3e1c7f036: add immutable snapshot_id and explicit AvailableTime; compare parsed KnowledgeCutoff::instant(); reject cross-snapshot rows; exclude same-snapshot post-cutoff evidence before duplicate/domain admission; preserve visible-duplicate refusal; bound raw population before identity allocation; derive document_count from admitted identities; terminal validation_status = "validated".
• e05a38ecd52f60aee8dcfaa039862c7526d35570: migrate integration contracts to explicit provenance and prove historical replay invariance when a future-unavailable row reuses a visible identity, cross-snapshot refusal, and raw-census admission.
• 742b65bc0dc4d8c745cf3bc1f7b924abd1de7b80: promote canonical corpus_split::cutoff_eligible to a production dependency and remove redundant dev-only declarations.
• 74f48935674a1ab4d7f4c563bf9887a3ba627ae5: return ADR 0064 from premature branch-local Accepted authority to Proposed.
• b780479fa9bcb9624e53dc79521899708163a05c: make non-exhaustive CitationEdgeError provider drift directly testable and fail closed; add a bounded-output proof before removing only the unreachable post-validation egress-size branch while preserving the untrusted from_json 256 KiB cap.
• f9e5a17f52e97efd0d2b564d31e8af4bdf8d93db: strengthen the wire proof to maximum 256-byte identifier lengths and the longest strict RFC 3339 timestamp form admitted by temporal_core.
• 1e6b3859b771062da3d164aa2f6f183e2d77549b: add a separate integration contract using 256-byte backslash identifiers so worst JSON escaping at the identifier boundary is exercised, not merely inferred from plain ASCII identifiers.
• ccf8c4ed05ee975f6256c495fca9a9a88dcc1b15 / 0e7e5f1ddb84ffad9d7ed54c0e9daf6bd54546a0: currentize ADR/doctoring with the bounded and fail-closed contract.

Historical replay invariant: same-snapshot evidence with AvailableTime > knowledge_cutoff cannot enter duplicate/domain admission, counts, artifact identity, or terminal result. Duplicate identities among evidence actually visible at the cutoff still fail closed. Cross-snapshot evidence is a provenance violation and is rejected rather than censored.

The protected-main provider currently returns ProvenanceIsNotTransition for every closed ProvenanceKind and exposes a non-exhaustive error enum. The adapter accepts only that exact refusal; unexpected success or another present/future provider error becomes InvalidEvidence. The artifact inference status remains provenance_is_not_a_state_transition; terminal provider validation is separately validated. edge_kind_recovery_rate stays library-side.

Review and documentation state

The valid inline finding that future evidence could enter historical censuses has been repaired, replied to, and resolved. Fresh thread sweep reports unresolved = 0. Submitted reviews are COMMENTED only; thread resolution is not approval and no qualifying current-head APPROVE exists.

Live ruleset 18156473 requires one qualifying current-head approval, dismisses stale approvals after pushes, requires review-thread resolution, and enforces the organization required workflows. The previous two-approval statement was stale.

docs/adr/0064-citation-edge-analysis-run.md is Proposed, but the shared docs/adr/README.md row added by this child still says Accepted. This remains a real docs-to-code mismatch on a large shared conflict surface. It has been handed to the #416/#435 consolidation lane rather than replacing unrelated ADR-index history from this child.

Exact-head evidence

Fresh workflows for exact head 1e6b3859b771062da3d164aa2f6f183e2d77549b:

• Rust Foundation CI 34789050641: queued;
• Documentation Quality 34789050607: pending;
• Security Scan 34789050561: queued;
• SAST Semgrep 34789050521: queued;
• CodeQL PR 34789050615: queued.

No predecessor check, coverage receipt, or review transfers to this head. This PR does not claim GREEN, 100% coverage, Ready, or merge authorization. Queue wait is lane-local; do not use no-op commits or blind/manual rerun loops merely to disturb admission.

Fold gate

Before successor-based Close, verify on the surviving #416/successor exact head that explicit snapshot/availability provenance, instant-based cutoff binding, cutoff-before-duplicate admission, historical replay invariance, cross-snapshot refusal, raw population bound, admitted-count semantics, exact provider-refusal drift guard, provider/domain status separation, bounded-output proof including worst JSON escaping, focused tests, ADR 0064 Proposed state, doctoring, TRACEABILITY and every other valid child delta survived ordinary conflict-resolving consolidation. Then reacquire exact-head authored line/branch coverage, required security/CodeQL/documentation workflows, resolved current findings and the qualifying independent approval on the unchanged survivor.

No self-approval, force push, destructive rebase, skip/xfail, coverage-denominator change, scanner suppression, no-op rerun, mutable dependency consumption, provider-routing copy, or predecessor evidence transfer is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[seonghobae]

Restack on protected main (a243f18)

Non-force merge of origin/main (merge commit 8f167a31); the only conflict was the CHANGELOG.md append, both entries kept. ADR 0064 already carries an admitted maturity value (active-PR).

Local evidence on the pushed head (toolchain 1.98.0): cargo test -p analysis_engine 37 passed / 0 failed, cargo clippy -p analysis_engine --all-targets -D warnings clean, cargo fmt --all --check clean, documentation/workspace/docstring contracts PASS, git diff --check clean.

🤖 Generated with Claude Code