feat(analysis): bind episode-membership refusals to an analysis-run profile

[seonghobae]

Consolidation status

fold_into_landing_vehicle — this Draft is now retargeted onto the provisional Validation / Analysis Run simple-refusal landing branch behind #416 (feat/copy-identity-analysis-run-gap-004). It no longer targets protected main directly.

Current base: #416@e0e44805acf3a5ec833e83baa37cc72c80544514. Current exact head: 04a254662fe8bce3f68e6e41a8290ca13d773fdb. GitHub now reports mergeable=false, exposing a real shared-file integration conflict rather than an independently shippable increment. Resolve the actual analysis_engine/workspace/docs integration while preserving #416 copy-identity + inferred-status repairs and this episode-membership profile; do not discard either side, force-push, or restore this child to a direct-main micro-PR.

ADR 0072 is implementation lineage pending repository-wide ADR normalization under #437, not standalone architecture authority.

Unique profile evidence to preserve

episode_membership_v1 / tepp.episode_membership.v1 binds the existing episode_membership::EventWindow and refuse_membership_outside_episode domain rule into cutoff-safe Analysis Run execution.

• Mixed contained / escaped corpora emit a digest-bound census with matching escape-refusal counts.
• Inference status remains membership_window_cannot_escape_episode_interval.
• identity_recovery_rate stays library-side; inspect payloads stay metric-free and never expose scientific_acceptance.
• Assignments whose AvailableTime is later than the knowledge cutoff are excluded.
• MAX_EVIDENCE_UNITS applies to execution and artifact validation; compact forged artifacts above that bound fail closed.
• Empty, single-class, duplicate assignment_id, and snapshot/profile/cutoff mismatch fail closed.

RED -> GREEN evidence

• RED 765e38c85621e054c01a3b8670ec1cdf5e3f17af: internally consistent compact EpisodeMembershipArtifact counts above MAX_EVIDENCE_UNITS must fail both to_json() and from_json() validation.
• GREEN 04a254662fe8bce3f68e6e41a8290ca13d773fdb: EpisodeMembershipArtifact::validate() enforces the same bound as execution.

DDD / landing rule

Episode membership remains domain vocabulary; the Analysis Run application / Validation boundary owns request admission, cutoff-safe evidence composition, digest-bound terminal projection and claim refusal. This profile does not create a bounded context.

The next source action is the conflict-resolving fold into a #416 successor head, preserving copy-identity, inferred-status and episode-membership source/tests/doctoring plus the shared Cargo/lib/lock/documentation surfaces. After that mutation, reacquire every applicable exact-head Rust Foundation CI, Documentation Quality, Security Scan, SAST and qualifying independent review required by live ruleset 18156473. Predecessor-head checks and reviews do not transfer. This Draft must not merge independently.

[seonghobae]

Operator-visible GAP-004 leftover / ADR 0072. Binds existing episode_membership::EventWindow + refuse_membership_outside_episode to episode_membership_v1 (tepp.episode_membership.v1). Inference membership_window_cannot_escape_episode_interval. AvailableTime cutoff exclusion and MAX_EVIDENCE_UNITS enforced. identity_recovery_rate stays library-side. Membership-window containment, not subevent-versus-parent. Distinct from #460 relation-absence, #458 outcome-order, #434 membership-target, #430 location-membership, and #416 copy-identity. Author COMMENT is not independent APPROVE. Two independent current-head APPROVEs required. Exact-head Checks on e6dc87e only. Do not self-approve.

[seonghobae]

Hour-37 shipped this slice after #460. Head e6dc87e. Author review is COMMENT not APPROVE. Two independent current-head APPROVEs required. Exact-head Checks on e6dc87e only. Do not self-approve. @opencode-agent review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Equivalent cutoffs reject valid runs

When a request uses an equivalent non-UTC offset, execute_episode_membership_run compares it with canonical UTC text. The valid run is rejected.

Suggested change

	if request.knowledge_cutoff != knowledge_cutoff.to_rfc3339()
	|| request.model_contract_version != EPISODE_MEMBERSHIP_MODEL_CONTRACT_VERSION
	|| request.output_profile != EPISODE_MEMBERSHIP_OUTPUT_PROFILE
	{
	return Err(AnalysisEngineError::InvalidEvidence);
	}
	let request_cutoff = KnowledgeCutoff::parse_rfc3339(&request.knowledge_cutoff)
	.map_err(|_| AnalysisEngineError::InvalidEvidence)?;
	if request_cutoff.instant() != knowledge_cutoff.instant()
	|| request.model_contract_version != EPISODE_MEMBERSHIP_MODEL_CONTRACT_VERSION
	|| request.output_profile != EPISODE_MEMBERSHIP_OUTPUT_PROFILE
	{
	return Err(AnalysisEngineError::InvalidEvidence);
	}

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

superseded_by_fold — unique episode_membership_v1 source, tests, ADR 0072, and doctoring are on surviving #416 head 3ae423da203033a64dad1ffba708cb6725bbd0d8 via --no-ff merge 1fb1efcdbf790e9dc70ea652682e4cd55820ddc9. Shared Cargo/lib/lock/docs surfaces were unioned; copy-identity, inferred-status, and location-membership evidence were not discarded. This child is landing-vehicle lineage, not implemented-main. Do not restore it as a direct-main Analysis Run micro-PR.