feat(evidence): bind structured value to node and network provenance

[seonghobae]

Partial implementation of #28, stacked on exact PR #99 head 8ec18b8701104cf3f3764334601c69c1497297b9.

Buyer-visible gap

Issue #28 requires the controlled real-browser workflow to extract one structured value and prove its source node/network evidence. Existing provenance can represent one verified source and #99 binds node-state success to an exact semantic node, but there was no value object that bound one extracted structured field digest to both the exact OriginWeave node and independently verified node + network provenance. A later runtime could therefore return a value and separate evidence records without proving that they belong to one same-origin evidence bundle.

Dependency

This Draft targets PR #99 branch feat/action-outcome-node-binding at unchanged exact head 8ec18b8701104cf3f3764334601c69c1497297b9. Keep Draft while #99/#80/#64 remain active. No prerequisite check, review, status, coverage, or mergeability evidence transfers.

TDD / RCA sequence

1. Test-only head 547d6345bc1a1fdf5ab2fb4558ef1b98f7f18692 introduced the bounded structured-value provenance contract. Its CI run 31556563496 was cancelled by later head movement, so it is not promoted as production-boundary RED evidence.
2. Formatting-only test head bb6b2fa09998084ee638ee715ecef6bb0b7e8163 reached the intended production boundary. CI run 31556648278, Rust contracts job 93990341184, passed repository contracts and canonical formatting, then failed at the workspace check because the public structured-value evidence API did not yet exist. This is the valid initial RED.
3. Production head 63530aa203dccd94c7a4144186da5208353db5c6 added the narrow evidence bundle. Its Rust contracts passed, but Production coverage in CI run 31556803181 failed exact function/line/region coverage. Exact coverage artifact 9126295264 localized every uncovered line to StructuredValueEvidenceError's new Display match arms: tests asserted typed variants but did not exercise their stable public error text.
4. Coverage head 139ab7d3ce66245b83b5c7d1245a654387431af9 added one focused source-free error-contract regression. CI run 31557284094 became fully GREEN, including Rust contracts job 93992172012 and Production coverage job 93992171998.
5. Changelog head dcca443f7d483b08579ab335ad9346ce13eeffdb recorded the new boundary and passed fresh CI 31557511767.
6. A current-code audit then found a narrower data-integrity defect: the structured-field predicate allowed punctuation-only identifiers such as ---, even though those values do not identify a semantic field. Exact test-only head 4cf977fbe5b41c76f14dfbaae2c4766331f668ef added that hostile case. CI run 31557841624, Rust contracts job 93993752193, passed repository contracts, formatting, and the workspace check, then failed in the focused tests as intended because production still accepted ---.
7. Current exact head b05cf7d5d45f8772fa8ea9f23cdd99d51a599f9e applies the narrow root-cause repair: a field identifier must still use only ASCII alphanumeric/underscore/hyphen bytes and must now contain at least one ASCII alphanumeric byte. CI run 31557992269 is fully GREEN: Rust contracts job 93994187786 and Production coverage job 93994187746 both succeeded, including repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage.

Implemented boundary

StructuredValueEvidence now:

• binds a bounded semantic structured-field identifier to a canonical lowercase SHA-256 digest of the extracted value bytes;
• accepts only ASCII alphanumeric, underscore, and hyphen field bytes and rejects punctuation-only identifiers by requiring at least one ASCII alphanumeric byte;
• retains the exact OriginWeave-owned ObservedNodeHandle rather than a raw protocol/DOM identifier;
• requires independently verified DOM/accessibility provenance for the source node;
• requires independently verified NetworkResponse provenance for the associated network source;
• requires both provenance records to carry the same canonical origin as the exact source node;
• rejects malformed identifiers/digests, unverified evidence, wrong evidence kinds, and cross-origin evidence with stable credential-free typed errors; and
• carries no raw extracted value.

The exact-current tests cover the public getters, empty/whitespace/slash/punctuation-only/oversized field boundaries, malformed digest boundaries, every verification/kind/origin denial, and every public error Display/Error::source path.

Exact-head proof

On unchanged exact current head b05cf7d5d45f8772fa8ea9f23cdd99d51a599f9e against unchanged exact prerequisite #99 head 8ec18b8701104cf3f3764334601c69c1497297b9:

• CI run 31557992269: success;
• Rust contracts job 93994187786: success;
• Production coverage job 93994187746: success, including exact owned production function/line/region/branch enforcement;
• GitHub reports the Draft mergeable against its exact prerequisite base; and
• no formal reviews are currently returned.

No cancelled, predecessor-head, prerequisite, synthetic, or skipped evidence is promoted as current proof.

Truth boundary

This slice is a credential-safe evidence composition primitive, not extraction or browser/network observation itself. It does not carry the raw extracted value, authenticate a browser/network adapter, prove that supplied provenance locators actually identify the exact node/response, compute a digest from trusted runtime bytes by itself, persist evidence, or complete the controlled Chromium workflow. The trusted adapter/runtime remains responsible for deriving the digest and source records from real bounded observation immediately around extraction.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 48c474b0-2f12-4ea7-b50b-b64baf2eab5e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}