feat(sensitive): fail closed on unreviewed model fallback

[seonghobae]

Partial implementation of #10, stacked on PR #84.

Buyer/security gap

Issue #10 requires provider outage or route-policy mismatch to fail closed rather than silently falling back to a less trusted model. The existing sensitive-model route/invocation/output stack binds exact reviewed provider/model/region and policy metadata, but it had no separate production primitive that decides whether an alternate route may be used after the primary route becomes unavailable.

Dependency

This Draft is stacked on unchanged exact PR #84 head 62f69cadbe0b4011fec67f9e482b04c4cacf181b and must remain Draft while that prerequisite and its sensitive-data stack remain active.

TDD / RCA sequence

1. Exact test-only head ad5696c8ee31a2f8d31a23be5c4a4aef532bb3a7 established the intended fallback-policy contract before production integration.
2. Production head 110cf838acff75e367d2c8e97ded3b16936fab61 added the deterministic fallback evaluator, but CI run 31493644963, Rust contracts job 93785884359, failed at the locked workspace check with E0432 because the new module was not declared or exported from the crate root. The fallback implementation therefore existed but could not enter the public production boundary exercised by the integration tests.
3. Head 0c864d49b3b48f3dc6c5c575059c99f417b62d00 added the missing module declaration and public exports. Production coverage in run 31494911041, job 93790084012, reached exact GREEN, while Rust contracts job 93790083845 correctly failed the canonical formatting gate in model_fallback.rs.
4. Head f4ebe1efabeeb416eccbf54177e43f897f878765 applied only the exact rustfmt diagnostics. CI run 31495206493 became fully GREEN: Rust contracts job 93791058252 and Production coverage job 93791058330 both succeeded, including repository contracts, formatting, locked workspace/all-target check, tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage.
5. Current exact head a2c391a5e038dc9e3d6978885d9bdd943487294f adds only the truthful Unreleased changelog entry. Fresh exact-head CI run 31495714541 is GREEN: Rust contracts job 93792779027 and Production coverage job 93792779288 both completed successfully with the same full contract and exact coverage gates.

Implemented contract

The branch now requires:

• exact primary-route policy to be evaluated before availability or fallback;
• primary route policy mismatch to fail closed and never become a reason to try a fallback;
• unknown primary availability to fail closed;
• unavailable primary with no explicitly reviewed fallback to fail closed;
• fallback request and trusted scope to both declare the fallback or fail closed; and
• only an exact fallback route independently authorized by the existing sensitive model-route policy to be selected.

No formal reviews or inline review threads are currently returned for this exact head. No predecessor-head check, review, mergeability result, or synthetic status is transferred to the current head.

Truth boundary

This pure policy slice does not detect provider health, authenticate or invoke a provider, disclose protected values, execute retries, choose latency/cost heuristics, persist routing state, attest region, or make an alternate model trusted. ModelRouteAvailability remains caller-supplied trusted-runtime evidence; a future trusted broker/orchestrator must derive that evidence and execute only the exact route selected by this policy boundary.

Keep Draft while #84 and its prerequisite sensitive-data stack remain active. This PR does not close #10; fresh exact-head/live-base acceptance is required again after any dependency movement.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9cc97b1d-4777-4adf-9dc6-04ade05ceb46

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}