fix(core): expose standard action-intent digest error contract

[seonghobae]

Buyer/reliability gap

originweave-core::ActionIntentDigestError is a public validation failure type, but protected main does not yet ship the standard Rust Display / std::error::Error contract for it. Downstream adapters would otherwise have to special-case malformed action-intent digest failures instead of retaining typed context through ordinary Rust error chains.

Test-first / review lineage

Exact test-only 1ca00abd4f1a62775306c7116c3c70ef721b04c6 required deterministic credential-free text for InvalidFormat and empty Error::source() before production support existed. Production added exhaustive Display plus source-free std::error::Error. A later review caught the syntax-significant sha256: colon omission; implementation and focused regression retain the exact sha256: plus 64 lowercase hexadecimal-digit shape.

Protected-main overlap repair

Protected main is exact 4ed08bfa7c063fc7f2ef9278ee8d281887b8296b through #284. Review 5115892007 identified that predecessor head 5bc3ed516ff516bcdd737ee8291222d4ca4701b4 was one protected-main commit behind and its CHANGELOG.md delta dropped the already protected Credential-free verified TCP evidence ... entry while adding the intended action-intent diagnostic wording.

Current commit a5e317e1a544728b2eb823f5651888783e2d3a97 repairs that overlap non-destructively. It preserves predecessor #160 as first parent, adopts exact protected main as second parent, rebuilds the tree from protected main plus only the three feature paths, and advances the branch with force=false. The protected verified-TCP changelog entry is retained; the only semantic changelog change is the intended standard-error wording (digest → evidence-digest, action-intent-digest). The reconstructed file also has a terminal newline; no feature or authority semantics depend on that formatting normalization.

Fresh compare from protected main is 9 ahead / 0 behind with merge base exactly 4ed08bfa... and exactly three semantic paths: CHANGELOG.md, crates/originweave-core/src/lib.rs, and crates/originweave-core/tests/action_intent_digest_error_contract.rs. No .github/**, dependency, browser/network authority, policy decision, secret, ruleset, coverage denominator, or release mutation is present.

Exact-current evidence

Current exact head is a5e317e1a544728b2eb823f5651888783e2d3a97, open, Draft, and parent-current. Fresh exact-head workflows have materialized but are non-terminal:

• CI 33903967884: queued;
• Manifest V3 Compatibility 33903968027: queued;
• Security Scan 33903967886: queued;
• SAST Semgrep 33903967972: queued; and
• CodeQL PR 33903967905: queued.

No predecessor GREEN or review transfers to this reconstructed head. Keep Draft until repository contracts, strict Rust checks/rustdoc, exact owned-production coverage, applicable security checks, and current review evidence are terminal on this unchanged SHA.

Scope boundary

This implements only the standard diagnostic contract for malformed action-intent digests. It changes no digest syntax, policy decision semantics, action authority, secret handling, browser execution, workflow, persistence, or release behavior.

Protected-main AGENTS.md and live GitHub governance remain authoritative. This scheduled writer does not merge, self-approve, alter workflows/rulesets/secrets, force-push, destructively rebase, weaken checks, tag, release, or publish.

[coderabbitai]

📝 Walkthrough

Walkthrough

ActionIntentDigestError에 표준 Display 및 std::error::Error 구현을 추가했습니다. InvalidFormat 메시지와 source() 결과를 테스트하고, 실패 계약 명칭을 변경 기록에 반영했습니다.

Changes

다이제스트 오류 계약

Layer / File(s)	Summary
ActionIntentDigestError 표준 오류 계약 crates/originweave-core/src/lib.rs, crates/originweave-core/tests/action_intent_digest_error_contract.rs, CHANGELOG.md	ActionIntentDigestError가 sha256: 접두사와 64개의 소문자 16진수를 요구하는 고정 메시지를 표시합니다. std::error::Error::source()는 None을 반환합니다. 테스트와 변경 기록이 이 계약을 반영합니다.

Estimated code review effort: 1 (사소함) | ~5분

Merge Risk: 🔵 Low · up to 91a55

Malformed action-intent digest errors currently omit the required sha256: prefix, producing an incorrect message for callers and tests. The risk is localized and mergeable with explicit owner follow-up to correct the implementation and expectation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 ActionIntentDigestError의 표준 Rust 오류 계약 공개라는 주요 변경 사항을 정확히 설명합니다. 간결하고 구체적이며 변경 내용과 직접 관련됩니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/action-intent-digest-error-contract

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1cdc7cf4cad53804da5abd15a99244ce341d05ae.

• Head SHA: 1cdc7cf4cad53804da5abd15a99244ce341d05ae

• Workflow run: 32167741751

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 1cdc7cf4cad53804da5abd15a99244ce341d05ae
• Workflow run: 32171245359
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1cdc7cf4cad53804da5abd15a99244ce341d05ae.

• Head SHA: 1cdc7cf4cad53804da5abd15a99244ce341d05ae

• Workflow run: 32171245359

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 1cdc7cf4cad53804da5abd15a99244ce341d05ae.

• Head SHA: 1cdc7cf4cad53804da5abd15a99244ce341d05ae

• Workflow run: 32171245359

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Dismissed as stale automated coverage review: exact current head 5bc3ed5 has terminal successful Rust contracts and Production coverage, with no unresolved review threads. This dismissal does not supply or bypass the required independent approval.

[seonghobae]

Current-head repair finding on 5bc3ed516ff516bcdd737ee8291222d4ca4701b4: fresh compare against protected main@4ed08bfa7c063fc7f2ef9278ee8d281887b8296b is 8 ahead / 1 behind with merge base c789b802fc98a8d7fd8c09d9327f36828054d2a1. The current CHANGELOG delta also drops protected-main’s existing Credential-free verified TCP evidence ... entry while adding the intended action-intent-digest diagnostic wording. Treat this as a restack/overlap repair, not as reason to close valid work: reconstruct non-destructively from current main, preserve current-main CHANGELOG content byte-for-byte except the intended action-intent diagnostic addition, then obtain fresh exact-head checks. No force-push or predecessor GREEN transfer.

[seonghobae]

Current-head reconstruction review: exact a5e317e1a544728b2eb823f5651888783e2d3a97 now has protected main@4ed08bfa... as an ancestor with 0 behind. The previous overlap defect is repaired: protected-main Credential-free verified TCP evidence ... remains present while the feature keeps the ActionIntentDigestError Display/Error contract and focused regression. Current semantic scope is three paths and contains no .github/** delta. Exact-head CI/security workflows are newly materialized and still queued, so this is a parent-lineage/source repair verification only, not GREEN or merge-ready evidence.