feat(sensitive): bind model prompt and token policy

[seonghobae]

Partial implementation of #10, stacked on PR #75.

Buyer/security gap

Issue #10 requires any sensitive-data model disclosure path to bind a reviewed prompt contract, output schema, and bounded token budget in addition to the already active provider/model/region/retention/training/subprocessor/export route authority. A route match alone must not authorize an unbounded or differently shaped model invocation.

Dependency

This Draft is stacked on unchanged exact PR #75 head 286f92aae9e298ab7dff1fd81c7850aabd5692ce and must remain Draft while #75 and its sensitive-handle prerequisites remain active.

TDD and implementation state

The original test-only head 8099a24093407ac0e69f9530d180da5f90e592fa established the missing production boundary. Exact current head adb67f8de3e4828db14dfa0e2950b672b60709c5 now implements and exposes ModelInvocationRequest, ModelInvocationScope, ModelInvocationDecision, and evaluate_model_invocation.

The production evaluator:

• preserves exact ModelRouteDecision denial before invocation-specific checks;
• binds one bounded prompt-contract identifier and one bounded output-schema identifier;
• requires nonzero requested input/output token budgets;
• requires nonzero reviewed maximum input/output budgets; and
• authorizes only when requested budgets do not exceed the reviewed maxima and both identifiers match exactly.

Exact-head CI run 31477512549 completed successfully. The combined commit status currently reports CodeRabbit success, no formal reviews are returned, and no inline review threads are currently returned for this exact head. Predecessor-head evidence is not transferred.

Truth boundary / remaining #10 work

Matching invocation metadata remains separate from raw-value disclosure, provider authentication, model execution, output validation, retention enforcement, expiry, conversation-history isolation, fallback selection, and export execution. In particular, this head deliberately does not provide invocation-policy expiry; Draft PR #79 carries a separate test-first expiry contract stacked on this exact head.

This PR must remain Draft until its dependency stack is integrated and fresh exact-head/live-base acceptance is re-established. It does not close #10.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ba58f282-a16c-4dc6-93c7-14375cdb0a4c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}