feat(evidence): verify capture packages offline

[seonghobae]

Partial implementation of #199, stacked on the independently resolved current PR #222 branch.

Buyer-visible boundary

This Draft implements one bounded offline-replay verification boundary over the exact artifacts a buyer retained. verify_offline_capture_package accepts an expected CaptureManifest, exact persisted manifest bytes, the extraction schema, typed WARC/PROV pairs, exact persisted (WARC bytes, PROV JSON-LD bytes) pairs in canonical record order, and structured-value digest bindings.

Verification is fail-closed and ordered: persisted manifest bytes must match first; persisted record-pair count must equal the typed record inventory; each persisted WARC artifact must equal WarcResourceRecord::to_warc_bytes() byte-for-byte; each persisted PROV artifact must equal WarcProvBundle::to_json_ld() byte-for-byte; and only then is the full schema/WARC/PROV/value identity reverified. Typed errors retain the zero-based failing record index for WARC or PROV byte drift without retaining artifact bytes.

This closes the prior gap where caller-reconstructed trusted in-memory WARC/PROV objects could verify even if separately retained WARC or PROV bytes had drifted. The verifier still performs no parsing or execution of captured content, DNS, network access, browser execution, JavaScript, external-reference traversal, secret access, persistence mutation, retention decision, signing, or authority escalation. Byte identity does not authenticate the artifact producer or establish factual correctness.

Test-first repair evidence

The new persisted-artifact contract was introduced RED first: exact-head workspace checking failed while the required persisted-byte API/error contract was absent. The canonical owner branch was then repaired and strengthened with regressions for exact success, WARC-byte drift, PROV-byte drift, record-count mismatch, manifest-byte drift precedence, structured-value identity drift, missing typed WARC evidence, and typed diagnostic/source behavior.

Exact-current state and evidence

• protected main: 542ca1e9c0a863595b8b6697790005d2471f5413;
• independently resolved current base ref feat/capture-manifest-contract: 299a2bb946a5c0cc1bdc158d473e3138a7ca971c;
• exact current head feat/offline-replay-verification: f028cfb1d5e88493c2d9895e50dd42e4693b56bc;
• exact-head CI run 33321700530: success;
• Rust contracts job 99284719116: repository contracts, canonical formatting, workspace check/tests, strict Clippy, and rustdoc success;
• Production coverage job 99284718998: exact measurement, diagnostics upload, and exact coverage enforcement success;
• the PR remains Draft while prerequisite feat(evidence): bind deterministic capture manifest identity #222 remains Draft.

The PR API's stored base snapshot is not promoted over the independently resolved live base ref above. Current formal reviews and inline review threads must be evaluated from live GitHub state; no independent approval is claimed here. Same-head centralized SAST/Semgrep, Security Scan, OpenCode, Noema, Strix, browser, durable persistence, retention, and independent-review evidence are not inferred from native CI or predecessor heads.

Authority boundary

Offline verification is deterministic artifact and identity verification only. It does not parse or execute captured active content, contact origins, resolve DNS, authorize capture/replay/retention/export, grant browser/network/model/secret/persistence authority, or infer trust from the existence of WARC/PROV records. Durable persistence, retention, signing, and replay policy remain outside this boundary.

Protected-main AGENTS.md and live GitHub governance remain authoritative. This scheduled writer does not merge, self-approve, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head maintenance audit for cdd86e7 (base 68c24da):\n\n- CodeGraph trace confirms the offline replay path verifies deterministic persisted manifest bytes first, then reconstructs schema-bound WARC/PROV/value identity; it performs no network, source execution, persistence, signing, or authorization action.\n- Local evidence on Rust 1.97.1: originweave-evidence all-target tests passed (61 tests, including 5 offline replay tests), evidence clippy with -D warnings passed, fmt check passed, and git diff --check passed.\n- Hosted exact-head checks are successful: Rust contracts and Production coverage.\n- No unresolved non-outdated review threads or formal approvals are present. The PR remains draft, so it is intentionally not marked ready or merged.