feat(evidence): add bounded WARC resource records

ARCHITECTURE.md

@@ -135,7 +135,7 @@ Owns validated task budgets and deterministic cumulative mitigation plans. Platf
 
 ### `originweave-evidence`
 
-Owns universally value-redacted network evidence and source-bound provenance records. Generic network records retain only bounded method, canonical origin, unambiguous bounded path, and bounded field names. Body capture, typed metadata values, WARC serialization, object storage, retention, encryption, and legal policy remain future bounded modules.
+Owns universally value-redacted network evidence and source-bound provenance records. Generic network records retain only bounded method, canonical origin, unambiguous bounded path, and bounded field names. Active PR #210 adds a bounded in-memory WARC 1.1 `resource` serializer over already-authorized bytes, with target URIs capped by the shared path ceiling and validated by the shared source-URL authority. This is active-PR evidence only; body persistence, retention, encryption, and legal policy remain future bounded modules.
 
 ## 6. Planned modules
 

CHANGELOG.md

@@ -45,6 +45,9 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Authoritative product documentation graph spanning PRD, TRD, ADR lifecycle/index, product-wide UML, conceptual ERD, requirement/decision traceability, threat modeling, product-wide test strategy, operability, API/protocol, release/rollback, and current primary-source standards doctoring, with machine-checkable repository contracts that keep conversation-derived future work distinct from protected-main implementation claims.
 - Purpose-bound data-governance and privacy baseline that rejects both blanket masking and ambient raw-value propagation, defines field-scoped just-in-time disclosure, opaque-handle/trusted-broker boundaries, model/provider/region policy, retention/deletion/residency/break-glass controls, truthful CSAP/SOC 2 readiness language, and machine-checkable documentation contracts without inventing an OriginWeave-owned production database.
 - Proposed product-wide target-architecture ADRs for the Rust control plane, isolated execution modes, typed actions, semantic observation/stale-node authority, prompt-injection and secret separation, resource-governor priority, provenance evidence, browser/protocol adapters, crawler policy, and hourly automation operational closure; these remain Proposed rather than shipped claims until protected review and merge.
+- The WARC/PROV child slice from PR #217, now integrated into the unprotected #210 feature branch, adds a bounded in-memory `WarcProvBundle` for deterministic W3C PROV-O JSON-LD projection and offline verification of exact WARC records; durable persistence, retention, and transport-specific export remain planned rather than shipped.
+- Connected the active WARC/PROV bundle evidence to the primary standards doctoring record, preserving the in-memory-only and non-shipped durable-adapter boundary.
+- Made WARC/PROV offline verification use the complete deterministic WARC digest as the authoritative block-digest binding, preserving fail-closed exact-record checks while keeping the public verifier surface minimal.
 
 ### Changed
 
@@ -70,6 +73,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Security
 
+- Provenance source URLs now reject case-insensitive and percent-encoded credential query-field names, including recursively encoded nested query-like values, and singly or recursively percent-encoded controls before query-bearing URLs can be retained or serialized into WARC target metadata.
 - Explicit proxy server identifiers require ASCII decimal port tokens before numeric range parsing, preventing Rust-specific leading-plus spellings from widening proxy authority.
 - Raw page content cannot become a trusted instruction.
 - Raw secrets are rejected and secret-capable actions require an opaque broker handle.
@@ -101,5 +105,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Hard RAM and VRAM pressure pauses the active agent and rejects new admission; hard VRAM pressure also offloads a resident local model.
 - The hourly product agent has no Git metadata or repository authority. A separate post-verification publisher opens one PR and cannot approve or merge it.
 - The unprivileged OpenCode user is restricted to loopback egress during model execution, preventing runner-wide allow-listed endpoints from becoming direct source-exfiltration channels.
+- WARC resource-record debug output now omits untrusted Content-Type parameters while retaining the full validated media type for WARC serialization.
+- Active PR #210 now bounds WARC target URIs at the shared path ceiling and reuses the shared source-URL parser, rejecting non-IP-literal bracketed authorities before provenance comparison; this remains active-PR evidence only.
 
-[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD
+[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD

crates/originweave-evidence/Cargo.toml

@@ -12,6 +12,7 @@ publish = false
 
 [dependencies]
 originweave-core = { path = "../originweave-core" }
+sha2 = "=0.10.9"
 
 [lints]
 workspace = true

crates/originweave-evidence/src/lib.rs

@@ -10,6 +10,8 @@
 mod extraction_schema;
 mod sensitive_access;
 mod sensitive_handle_lifecycle;
+mod warc_prov_bundle;
+mod warc_resource_record;
 
 pub use extraction_schema::{
     ExtractionCardinality, ExtractionField, ExtractionNormalizationRule, ExtractionSchema,
@@ -24,6 +26,15 @@ pub use sensitive_access::{
 pub use sensitive_handle_lifecycle::{
     SensitiveHandleLifecycleEvidence, SensitiveHandleLifecycleEvidenceInput,
 };
+pub use warc_prov_bundle::{
+    MAX_PROV_SOFTWARE_COMMIT_SHA_BYTES, WarcProvBundle, WarcProvBundleError,
+    WarcProvBundleVerificationError,
+};
+pub use warc_resource_record::{
+    MAX_WARC_CONTENT_TYPE_BYTES, MAX_WARC_DATE_BYTES, MAX_WARC_PAYLOAD_BYTES,
+    MAX_WARC_RECORD_ID_BYTES, MAX_WARC_TARGET_URI_BYTES, WarcPayloadCompleteness,
+    WarcResourceRecord, WarcResourceRecordError, WarcTruncationReason,
+};
 
 use std::collections::BTreeMap;
 
@@ -289,7 +300,7 @@ fn redact_all_values(values: BTreeMap<String, String>) -> BTreeMap<String, Strin
 }
 
 /// A provenance pointer from an extracted assertion to its exact evidence.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Clone, PartialEq, Eq)]
 pub struct ProvenanceRecord {
     source_url: String,
     source_locator: String,
@@ -298,6 +309,18 @@ pub struct ProvenanceRecord {
     verification_result: VerificationResult,
 }
 
+impl std::fmt::Debug for ProvenanceRecord {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ProvenanceRecord")
+            .field("source_url_byte_count", &self.source_url.len())
+            .field("source_locator_byte_count", &self.source_locator.len())
+            .field("source_kind", &self.source_kind)
+            .field("verification_result", &self.verification_result)
+            .finish()
+    }
+}
+
 impl ProvenanceRecord {
     /// Validate and create one provenance record.
     pub fn new(
@@ -366,21 +389,197 @@ fn valid_source_url(source_url: &str) -> bool {
         || source_url
             .chars()
             .any(|character| character.is_control() || character.is_whitespace())
-        || source_url.contains(['?', '#', '\\'])
+        || source_url.contains(['#', '\\'])
     {
         return false;
     }
     let Some((scheme, remainder)) = source_url.split_once("://") else {
         return false;
     };
-    let authority_end = remainder.find('/').unwrap_or(remainder.len());
-    let authority = &remainder[..authority_end];
+    let (hierarchical, query) = remainder
+        .split_once('?')
+        .map_or((remainder, None), |(hierarchical, query)| {
+            (hierarchical, Some(query))
+        });
+    let authority_end = hierarchical.find('/').unwrap_or(hierarchical.len());
+    let authority = &hierarchical[..authority_end];
     let origin_text = format!("{scheme}://{authority}");
     if Origin::parse(&origin_text).is_err() {
         return false;
     }
-    let path = &remainder[authority_end..];
-    path.is_empty() || validate_path(path).is_ok()
+    let path = &hierarchical[authority_end..];
+    if !path.is_empty() && validate_path(path).is_err() {
+        return false;
+    }
+    query.is_none_or(valid_query)
+}
+
+fn valid_query(query: &str) -> bool {
+    let bytes = query.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        let byte = bytes[index];
+        if byte == b'%' {
+            let Some(high) = bytes
+                .get(index + 1)
+                .and_then(|byte| hexadecimal_value(*byte))
+            else {
+                return false;
+            };
+            let Some(low) = bytes
+                .get(index + 2)
+                .and_then(|byte| hexadecimal_value(*byte))
+            else {
+                return false;
+            };
+            let decoded_byte = high * 16 + low;
+            if decoded_byte.is_ascii_control() {
+                return false;
+            }
+            decoded.push(decoded_byte);
+            index += 3;
+            continue;
+        }
+        if !is_rfc3986_pchar(byte) && !matches!(byte, b'/' | b'?') {
+            return false;
+        }
+        decoded.push(byte);
+        index += 1;
+    }
+    if recursively_encoded_control(&decoded) {
+        return false;
+    }
+    query.split('&').all(|field| {
+        let (name, value) = field
+            .split_once('=')
+            .map_or((field, ""), |(name, value)| (name, value));
+        !is_credential_query_name(name) && !nested_query_contains_credential(value)
+    })
+}
+
+fn recursively_encoded_control(bytes: &[u8]) -> bool {
+    let mut candidate = bytes.to_owned();
+    loop {
+        let mut decoded = Vec::with_capacity(candidate.len());
+        let mut index = 0;
+        let mut found_escape = false;
+        while index < candidate.len() {
+            if candidate[index] == b'%' {
+                let Some(high) = candidate
+                    .get(index + 1)
+                    .and_then(|byte| hexadecimal_value(*byte))
+                else {
+                    decoded.push(candidate[index]);
+                    index += 1;
+                    continue;
+                };
+                let Some(low) = candidate
+                    .get(index + 2)
+                    .and_then(|byte| hexadecimal_value(*byte))
+                else {
+                    decoded.push(candidate[index]);
+                    index += 1;
+                    continue;
+                };
+                let decoded_byte = high * 16 + low;
+                if decoded_byte.is_ascii_control() {
+                    return true;
+                }
+                decoded.push(decoded_byte);
+                index += 3;
+                found_escape = true;
+                continue;
+            }
+            decoded.push(candidate[index]);
+            index += 1;
+        }
+        if !found_escape {
+            return false;
+        }
+        candidate = decoded;
+    }
+}
+
+fn nested_query_contains_credential(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' {
+            let high = hexadecimal_value(bytes[index + 1]).unwrap_or(0);
+            let low = hexadecimal_value(bytes[index + 2]).unwrap_or(0);
+            decoded.push(high * 16 + low);
+            index += 3;
+        } else {
+            decoded.push(bytes[index]);
+            index += 1;
+        }
+    }
+    decoded
+        .split(|byte| *byte == b'?')
+        .skip(1)
+        .any(|nested_query| {
+            nested_query.split(|byte| *byte == b'&').any(|field| {
+                let name_end = field
+                    .iter()
+                    .position(|byte| *byte == b'=')
+                    .unwrap_or(field.len());
+                let name = &field[..name_end];
+                name.contains(&b'%') || is_credential_query_name_bytes(name)
+            })
+        })
+}
+
+fn is_credential_query_name(name: &str) -> bool {
+    let bytes = name.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' {
+            let high = hexadecimal_value(bytes[index + 1]).unwrap_or(0);
+            let low = hexadecimal_value(bytes[index + 2]).unwrap_or(0);
+            decoded.push(high * 16 + low);
+            index += 3;
+        } else {
+            decoded.push(bytes[index]);
+            index += 1;
+        }
+    }
+    decoded.contains(&b'%') || is_credential_query_name_bytes(&decoded)
+}
+
+fn is_credential_query_name_bytes(decoded: &[u8]) -> bool {
+    let mut decoded = decoded.to_owned();
+    decoded.make_ascii_lowercase();
+    decoded.iter_mut().for_each(|byte| {
+        if *byte == b'-' {
+            *byte = b'_';
+        }
+    });
+    matches!(
+        decoded.as_slice(),
+        b"access_token"
+            | b"api_key"
+            | b"auth"
+            | b"authorization"
+            | b"client_secret"
+            | b"credential"
+            | b"key"
+            | b"password"
+            | b"secret"
+            | b"secret_key"
+            | b"session"
+            | b"sig"
+            | b"signature"
+            | b"token"
+            | b"x_api_key"
+            | b"x_amz_credential"
+            | b"x_amz_security_token"
+            | b"x_amz_signature"
+            | b"x_goog_credential"
+            | b"x_goog_signature"
+    )
 }
 
 fn valid_sha256(source_hash: &str) -> bool {