feat(evidence): bind WARC records to PROV JSON-LD

[seonghobae]

Partial implementation of #199, stacked on the exact current PR #210 head.

Buyer-visible boundary

This Draft implements the next evidence-native replay boundary after schema admission and immutable WARC resource records: a bounded deterministic W3C PROV-O JSON-LD bundle that binds one already-validated WARC record to its verified source entity, one capture activity, the exact OriginWeave software revision, explicit WARC payload-completeness state, the retained payload block digest, and a SHA-256 digest of the complete deterministic WARC serialization. Raw WARC payload bytes are not embedded in the provenance document.

The in-memory bundle exposes deterministic offline verification against a candidate validated WarcResourceRecord. Verification binds the complete validated ProvenanceRecord together with WARC identity, capture time, payload digest, completeness state, and serialized-record digest. This is evidence identity checking only; it does not authenticate an actor or establish factual correctness.

Exact-current state and evidence

• current exact base: PR feat(evidence): add bounded WARC resource records #210 bea65643109449d63d367a35b8d9bf327ee7cb2c;
• current exact head: 6b8a3fdeae52ad94b90086bbc9b42863b90c9614;
• the merge repair incorporates the exact current PR feat(evidence): add bounded WARC resource records #210 base and resolves the docs/doctoring.md conflict;
• Local full Python 155 tests and 549 subtests plus pinned Rust workspace verification passed before the repair commit; hosted checks were regenerated for this exact head;
• current formal reviews and inline review threads contain no counted independent approval; no predecessor result transfers.

Same-head centralized SAST/Semgrep, Security Scan, OpenCode, Noema, Strix, browser, persistence, retention, and independent-review evidence are not claimed until they actually run for this head.

Authority boundary

The bundle is an immutable, payload-free provenance projection. It grants no capture, browser, network, model, secret, persistence, retention, deletion, export, signing, or release authority. Durable storage and replay policy remain outside this in-memory boundary.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0eccc246-9168-4f8c-ae36-e675a22b4ace

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head maintenance note for 85eef87c8610565a5c4f25d142bd634f82dfd373 (stacked base a18429b1ebe27a8d9853bb1e43164449d40e1ead): documented the public WarcProvBundle boundary in ADR 0106 and CHANGELOG. The record remains a bounded in-memory W3C PROV-O JSON-LD projection with deterministic offline verification; durable persistence, retention, and transport-specific export remain planned. Added a regression contract for these claims. Python 154 tests, full Rust workspace tests/doctests, strict clippy, rustfmt, rustdoc with warnings denied, compileall, and git diff --check passed under Rust 1.97.1. CI and Devin are now running for this exact head; predecessor review evidence is not being reused.

[seonghobae]

Current-head audit for 1d5d2939b594c54ce14aa831fa850d5d91e34db5 against base 717fa4adb74cc700e80af31efaeb9ea3ce77952d: fixed the exact Production coverage failure from the predecessor head by removing the redundant unreachable payload-digest branch; deterministic WARC serialization digest remains the authoritative block-digest binding, with a tampering regression test and doctoring/CHANGELOG updates. Local Rust 1.97.1 workspace tests, check, Clippy, rustdoc, format/diff checks, and exact nightly coverage all passed; verify_coverage.py reports functions/lines/regions/branches at 100%. Hosted Rust contracts and Production coverage are SUCCESS for this exact head. ReviewDecision is empty, no formal counted approval is present, and unresolved non-outdated review threads are 0; no merge or readiness claim is made.