feat(evidence): add bounded WARC resource records - #210
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthrough
ChangesWARC resource 레코드
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: 🟠 High · up to This PR adds WARC resource serialization, but the current implementation can allow multiply encoded nested credential parameters to bypass admission and be emitted in WARC-Target-URI, while payload binding and a WARC header assertion still have unresolved correctness concerns. Merge should be blocked until these security and correctness issues are fixed. Sequence Diagram(s)sequenceDiagram
participant 호출자
participant ProvenanceRecord
participant WarcResourceRecord
participant SHA256Digest
participant WARCBytes
호출자->>ProvenanceRecord: 쿼리 URL과 출처 해시 제공
호출자->>WarcResourceRecord: new_with_completeness 호출
WarcResourceRecord->>ProvenanceRecord: source URL과 검증 상태 확인
WarcResourceRecord->>SHA256Digest: 보존된 payload 전달
SHA256Digest-->>WarcResourceRecord: SHA-256 block digest 반환
WarcResourceRecord->>WARCBytes: WARC 헤더와 payload 전달
WARCBytes-->>호출자: 결정적 WARC/1.1 바이트 반환
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 51.35% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 74 functions across 10 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
ARCHITECTURE.md— repository behaviorCHANGELOG.md— repository behaviorCargo.lock— Rust workspace or package manifestcrates/originweave-evidence/Cargo.toml— Rust workspace crate API and testscrates/originweave-evidence/src/lib.rs— Rust workspace crate API and testscrates/originweave-evidence/src/warc_resource_record.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/evidence.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/provenance_query_urls.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/warc_debug_redaction.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/warc_field_limit_errors.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/warc_payload_provenance_binding.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/warc_resource_record.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/warc_target_uri_presentation.rs— Rust workspace crate API and testscrates/originweave-evidence/tests/warc_truncation_state.rs— Rust workspace crate API and testsdocs/adr/0106-provenance-evidence-model.md— operator or user guidancedocs/doctoring.md— operator or user guidance
Changed behavior
classDiagram
class HttpMethod
class EvidenceSourceKind
class VerificationResult
class EvidenceError
class NetworkEvidence
class capture
class path
class ProvenanceRecord
Changed API
HttpMethodEvidenceSourceKindVerificationResultEvidenceErrorNetworkEvidencecapturepathProvenanceRecordnewsource_urlsource_locatorsource_hashWarcTruncationReasonWarcPayloadCompletenessWarcResourceRecordErrorWarcResourceRecordnew_with_completenessrecord_idwarc_datetarget_uricontent_typepayloadblock_digestto_warc_bytes
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
0341079331f9cea669eb9a5cc21842fd6027431e - Workflow run: 33179004673
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
classDiagram
class HttpMethod
class EvidenceSourceKind
class VerificationResult
class EvidenceError
class NetworkEvidence
class capture
class path
class ProvenanceRecord
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
* test(evidence): require WARC PROV JSON-LD bundle * feat(evidence): add bounded WARC PROV bundle * feat(evidence): expose WARC PROV bundle * test(evidence): cover provenance debug redaction * test(evidence): preserve WARC completeness in PROV * fix(evidence): retain WARC completeness in PROV * test(evidence): pin completeness-aware PROV output * style(evidence): apply canonical Rust formatting * style(evidence): format completeness regression * docs(evidence): record completeness-aware PROV bundle * docs(evidence): doctor PROV completeness semantics * test(evidence): prove PROV binds exact WARC record * fix(evidence): bind PROV to serialized WARC record * test(evidence): pin serialized WARC digest in PROV * test(evidence): require offline WARC PROV verification * feat(evidence): verify WARC PROV bindings offline * feat(evidence): export offline WARC PROV verification error * docs(changelog): record offline WARC PROV verification * test(evidence): require exact WARC provenance binding * fix(evidence): bind offline PROV verification to exact source evidence * style(evidence): apply canonical rustfmt * test(evidence): keep provenance regression clippy-clean * test(prov): reject null software revision identity * fix(prov): reject null Git software identity * feat(evidence): expose PROV bundle on current stack * docs(evidence): document WARC PROV bundle boundary * docs(evidence): trace WARC PROV bundle boundary * refactor(evidence): share WARC truncation tokens * fix: make WARC provenance digest binding authoritative
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
1 participant
Buyer-visible boundary
This PR adds a bounded in-memory WARC 1.1 resource record over already-authorized bytes. It binds the target URI to independently verified provenance, bounds record fields before serialization, emits deterministic bytes, records complete-versus-truncated capture state, and preserves credential-free evidence behavior.
Safe query-bearing resource URLs remain supported. Provenance admission rejects case-insensitive and percent-encoded credential field names at the top level and inside nested query-like values, rejects residual nested percent-encoding in credential names, and rejects singly or recursively percent-encoded ASCII controls before retention or WARC serialization.
Exact stack truth
Test-first security repair
This repair does not alter browser, network, TLS, proxy, secret-broker, persistence, retention, legal-hold, or governance authority.
Exact-current verification
No bypass, self-approval, merge, tag, publication, workflow mutation, secret change, or gate weakening is claimed.