feat(sensitive): deny unrelated model conversation history

[seonghobae]

Partial implementation of #10, stacked on PR #79.

Buyer/security gap

Issue #10 explicitly requires selective sensitive-model disclosure to carry no unrelated conversation history. The exact #79 boundary binds route, prompt/schema, token budgets and expiry, but its request metadata previously had no fail-closed representation for unrelated history that a trusted broker detected in the outgoing model message set.

Dependency

This Draft is stacked on exact PR #79 head 2ad7a2162b4842fe57f74f69f08b258f4f6a9c07, transitively on #77/#75 and the sensitive-handle prerequisites. It remains Draft while those dependencies remain active.

Test-first implementation

Exact test-only head a5a8c49993464f7c86b78b28ba5c1f191ef10ca8 established the missing context-isolation boundary. Exact current head 0ec604deb1c0293008560e0fcd4af7ccb65d93ad now adds broker-derived unrelated_history_items metadata to ModelInvocationRequest, authorizes only zero, and returns the stable UnrelatedConversationHistoryDenied decision for any positive count including u32::MAX. Exact route admission is still evaluated first, so a route failure remains a distinct RouteDenied result even when unrelated history is present.

This contract deliberately does not claim that a caller-supplied integer proves message isolation. The trusted broker/orchestrator must derive the count from the actual bounded outgoing message set; this pure policy layer makes a known nonzero condition impossible to authorize silently.

Exact-head verification

CI run 31484982600 completed successfully on exact head 0ec604deb1c0293008560e0fcd4af7ccb65d93ad. The branch is directly ahead of unchanged live base 2ad7a2162b4842fe57f74f69f08b258f4f6a9c07 with no base drift, and no formal reviews or inline review threads are currently returned for this head.

Truth boundary

This is context-isolation metadata only. It does not inspect model message payloads, classify message relevance, disclose protected values, authenticate/invoke a provider, validate output, enforce retention, authorize fallback/export, or complete issue #10. It remains Draft because its stacked dependencies are still active.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b0b3b14f-8e8b-4807-ba4f-de945829eb23

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}