feat(enterprise): add semantic issue provider boundary

[seonghobae]

Summary

Advances #404 with the next reviewable slice after the deterministic explicit-value parser merged in #533.

This draft starts a provider-neutral semantic issue extraction boundary that must return the existing AtomicIssueRecord contract, revalidate exact source revisions and source spans, reconstruct fresh canonical nested records, redact custom-provider failures, and retain no raw enterprise text. It must not create parallel issue, evidence, scoring, observation, result, or engine schemas and adds no numerical or utility arithmetic.

The authoritative implementation plan is in docs/superpowers/plans/2026-08-05-enterprise-semantic-issue-boundary.md.

Required validation before ready

• exact source and UTF-8 span replay;
• bounded source and output consumption;
• exact-type and fresh canonical reconstruction across nested issue/evidence/counterevidence records;
• provider exception redaction and privacy tests;
• deterministic offline fixture adapter without provider SDK coupling;
• complete public docstrings and 100% statement/branch coverage for added code;
• Ruff, changelog parity, full CI, Security Scan, SAST, packaging, and final review.

No version bump or release is intended for this isolated issue #404 slice.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 839669de-5817-4b25-bf3b-86f601d0a612

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@jules Implement the exact plan on this draft branch. Start from current head 80928a37a194369ece10a0477420e43eff96e1f1 and commit directly to feat/enterprise-semantic-issue-boundary.

Use the existing EnterpriseSourceRecord, EvidenceSpanRecord, CounterevidenceRecord, AtomicIssueRecord, and shared scoring contracts only. Add a runtime-checkable provider-neutral extractor protocol, one fail-closed public extraction entry point, and a deterministic offline fixture adapter. Revalidate exact source text and UTF-8 span bytes, bind source IDs to source-record fingerprints, consume untrusted iterables with explicit bounds, accept only exact output types, reconstruct fresh canonical nested records, deterministically order output, and redact every custom-provider exception without reflecting source or provider content. Preserve all five assertion kinds and keep counterevidence wrapped. Do not add a provider SDK, parallel request/issue/evidence/scoring schema, sentiment heuristic, numerical arithmetic, or causal/high-stakes claim.

Add adversarial mutation/subclass, exception-redaction, bounded-consumption, source/span replay, Unicode, deterministic-order, privacy, assertion-kind, package-export, migration/serialization, and metamorphic sentiment-independence tests. Require complete public docstrings and 100% statement plus branch coverage for added code. Update authoritative docs, changelog fragment, and rendered CHANGELOG.md; do not bump versions. Run Ruff, focused coverage, full feasible tests, changelog parity, and remove any temporary workflow/trigger artifacts before reporting exact commands and results. Keep the PR draft until exact-head CI, Security Scan, SAST, packaging, CodeRabbit, and final review are green.