feat(evidence): bind node-state success to exact target node

[seonghobae]

Partial implementation of #28, stacked on exact PR #80 head 55b1421e25c5b68ca5f3b05fab37db8f4f1e22be.

Buyer/correctness gap

PR #80 correctly binds NodeStateChanged success provenance to the governed target origin, but origin equality is broader than node authority. Two different semantic nodes in the same browser session/context/origin/document can both have verified same-origin provenance. Without exact node binding, an unrelated same-origin node could prove the post-condition for the governed action target.

Dependency

This Draft targets PR #80 branch feat/action-outcome-origin-binding at unchanged exact head 55b1421e25c5b68ca5f3b05fab37db8f4f1e22be; exact compare for current head reports behind_by=0 with merge base equal to that prerequisite. Keep Draft while #80/#64 remain active. No prerequisite check, review, status, or mergeability evidence is transferred.

TDD / RCA sequence

1. Exact test-only head e88e53a4945a0a745fac303b8bcfb980af2bfef3 required an OriginWeave ObservedNodeHandle-bound node-state evidence path. CI run 31550541187, Rust contracts job 93972106904, passed repository contracts and canonical formatting, then failed at the intended workspace/production boundary because the new node-bound API did not exist.
2. Production introduced a non-bypassable split: the generic constructor rejects NodeStateChanged, while new_node_state requires the exact governed target node and independently observed node to be identical across browser session, browsing context, canonical origin, document epoch, and node identifier. Existing verified-provenance and monotonic-order checks remain prerequisites.
3. Exact head 59f9893c68cdd8b454f1500dab4f190ad3510c56 passed Rust contracts, tests, strict Clippy, and rustdoc, but exact coverage correctly failed at one uncovered error-propagation region in new_node_state (action_outcome.rs:145). The focused follow-up therefore exercised unverified node-state provenance through that exact public path rather than weakening or excluding the gate.
4. Current exact head 8ec18b8701104cf3f3764334601c69c1497297b9 contains that realistic coverage regression only.

Implemented contract

VerifiedActionOutcomeEvidence now:

• preserves URL/dialog/network post-conditions through the existing generic constructor;
• rejects NodeStateChanged through the generic constructor as NodeStateTargetRequired, preventing origin-only evidence from bypassing node identity;
• provides new_node_state for exact node-state evidence;
• requires independently verified provenance and monotonic observation ordering before node/origin checks;
• requires provenance canonical origin to match the governed node origin;
• rejects a different same-origin observed node as PostConditionNodeMismatch; and
• retains the exact governed ObservedNodeHandle for node-state evidence while non-node evidence exposes no false node identity.

Exact-head proof

On unchanged exact head 8ec18b8701104cf3f3764334601c69c1497297b9 against unchanged exact prerequisite #80 head 55b1421e25c5b68ca5f3b05fab37db8f4f1e22be:

• CI run 31551314274: success;
• Rust contracts job 93974393944: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc all success;
• Production coverage job 93974393956: exact owned production function/line/region/branch enforcement success;
• exact-head CodeRabbit commit status: success;
• GitHub reports the Draft mergeable against its unchanged prerequisite base; and
• no formal reviews or inline review threads are currently returned for this exact head.

No predecessor-head result is promoted as current proof.

Truth boundary

This slice is an evidence-construction invariant only. It does not authenticate a browser adapter, dispatch input, prove that adapter-supplied node observations are truthful, observe a post-condition itself, authorize an action, attest a clock, persist evidence, or complete the Chromium vertical slice. Exact node identity remains OriginWeave-owned authority that a trusted adapter/runtime must supply immediately around real dispatch and observation.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5aa00115-3405-4573-883b-875df9a3067f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}