feat(sensitive): expire reviewed model invocation policy

[seonghobae]

Partial implementation of #10, stacked on PR #77.

Buyer/security gap

PR #77 binds sensitive-model admission to the exact route, reviewed prompt contract, reviewed output schema, and bounded input/output token budgets. Without an explicit invocation-policy lifetime, a request that matched reviewed metadata could be delayed or replayed after that review context should no longer authorize model disclosure.

Dependency

This Draft is stacked on unchanged exact PR #77 head adb67f8de3e4828db14dfa0e2950b672b60709c5, transitively on #75 and the active sensitive-handle prerequisites. It must remain Draft while those prerequisites are active.

TDD and implementation state

Test-only head eb7daf465f35b314b175a592cdb9d74962b64800 established the missing production boundary. CI run 31480649072 reached the intended Rust compile RED after repository contracts and formatting passed: production lacked the valid_until scope argument, caller-supplied trusted-time evaluator argument, and ModelInvocationDecision::InvocationExpired variant.

Production head 39ec1659541b10785fcd85a9531bdd8d823578e3 implements the bounded expiry contract and passed CI run 31480876883, including Rust contracts and exact Production coverage. Exact current head 2ad7a2162b4842fe57f74f69f08b258f4f6a9c07 adds only the truthful Unreleased changelog entry and passes exact-head CI run 31481128812.

The production evaluator now:

• retains exact model-route admission as the first prerequisite and preserves typed route denial;
• validates bounded prompt/output-schema identifiers, nonzero requested/reviewed token budgets, and a nonzero reviewed valid_until;
• authorizes only when trusted_time < valid_until;
• returns stable InvocationExpired at or after the exclusive deadline; and
• keeps malformed static invocation policy distinct as InvocationPolicyMismatch.

trusted_time remains caller-supplied policy input from the same authoritative time domain that issued valid_until; this pure policy boundary reads no wall clock and does not claim clock provenance.

Exact-current evidence

For exact head 2ad7a2162b4842fe57f74f69f08b258f4f6a9c07 on unchanged exact base adb67f8de3e4828db14dfa0e2950b672b60709c5:

• CI run 31481128812: success;
• predecessor production CI run 31480876883: success after the intended RED cycle;
• combined commit status reports CodeRabbit success;
• no formal reviews are currently returned; and
• no inline review threads are currently returned.

No predecessor-head review, status, or mergeability result is transferred as approval for this moved head.

Truth boundary

This is deterministic invocation-metadata freshness only. It does not disclose a protected value, authenticate or invoke a provider, isolate unrelated conversation history, validate model output, enforce provider retention, execute export, choose fallback, attest a trusted clock, or close #10. Those remain separate trusted broker/orchestrator boundaries.

This PR remains Draft until its dependency stack integrates and fresh exact-head/live-base acceptance is re-established.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7af57f49-8f64-4e97-a61d-1462d333f0e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}