fix(rag): replay evidence limitation integrity

[seonghobae]

Closes #1135. Advances #607.

Defect

RAGEvidenceRegimeLimitations is factory-sealed and frozen, but a legitimate instance can still be rebound after construction with object.__setattr__. The direct to_dict() / limitations_fingerprint paths then serialized live fields, so a caller-defined limitation_codes container could execute iteration while package-owned replay was establishing the evidence-limit contract.

RED → GREEN

• RED 1a1403eb521d14650fd4666e4dba4e8be62aa523: mutate a legitimate factory-created record with a hostile tuple subclass and require both manifest and fingerprint replay to fail with package-owned evidence-integrity error before caller iteration.
• GREEN 607e4d24dda97deba898fae91ae42a501d2451ca: re-establish exact record, enum, tuple, text, and package-derived limitation semantics before projection; serialize only a fresh factory-derived record.
• Coverage simplification fe525d780b82c53b66585fe6b85f3ae4621f473c: consolidate the replay state gate so valid records exercise the complete semantic comparison while the hostile-container regression exercises the fail-closed path.
• Test documentation 4ded2d01336b6ba726589543785142468ce883ce: document the hostile iterator fixture without changing behavior.
• Evidence 9a10e212e73e079c264444f1d19ea60f82976210: governed changelog fragment.

Preserved contract

All evidence regimes retain their existing negative-identification codes and deterministic fingerprints for legitimate factory-created records. No raw query/context/response content is introduced and no regime is upgraded into a world-truth authority.

Ownership boundary

Python schema/provenance replay only. No RAG scoring, retrieval, calibration, truth adjudication, likelihood, estimator, uncertainty, or other psychometric/statistical arithmetic changes. Production numerical ownership remains Rust-first.

Verification boundary

This branch is five commits ahead / zero behind protected main@04d0bc21a2a20693bcf16108cd76d394fe844d23 with a three-file effective diff. Keep Draft until exact-current-head CI/security/package/coverage and independent review evidence are terminal and clean; predecessor-head evidence does not transfer.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3fcc96b7-0757-4ad7-b1cf-926c4b615218

📥 Commits

Reviewing files that changed from the base of the PR and between 04d0bc2 and 9a10e21.

📒 Files selected for processing (3)

• docs/changelog.d/1135-rag-evidence-replay-integrity.md
• python/fast_mlsirm/scoring/rag_evidence.py
• tests/test_scoring_rag_evidence_limitations.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.