feat: bind full-text review decisions to retained evidence

[seonghobae]

Current verified repair checkpoint — 2026-09-06

Exact head: codex/zotero-fulltext-review-approval@8e057652ee7784b373beeeec865d80dd3db773be.
Exact base: codex/zotero-fulltext-review-context@692cb588b26a9cc878fbaa2b47aa30fd83ea47de.
Tested runtime: 61bb211f798e9b91e921e65bc12d988e4b080dee; the final documentation-only commit changes no runtime, dependency or verification scripts.

The earliest planner owner #13 retains committed RED 505e111c993d8269e5b7b9e17a25a5ce20f8606e and repair 8a684882005085d8b3cb47812e185975084e0475. Every existing local request/mode/item/metadata check now precedes the external approval verifier: invalid input makes zero calls and valid complete input exactly one. Local error precedence is intentional. This normally merged stack preserves every original child and verified parent, including all prior private-file/full-text repairs; no later feature was backported to an earlier owner.

Runtime verification: 240 tests / 41 unfiltered suites including three doctests, strict Clippy, fmt, warnings-denied rustdoc, CI contract, release build and unchanged coverage gate all pass. Coverage is 391/391 functions, 4394/4394 source-normalized regions and 728/728 normalized branches; raw LLVM remains 4747/4854 lines, 6939/7134 regions and 659/728 branches, not 100%. Do not transfer these local results into hosted or protected acceptance.

Current gap baseline records all 24 verified stack heads, canonical RED/GREEN, current protection, terminal CodeQL failures and the independently advancing Source Observation owner. PRD/TRD/UML/Proposed ADR 0007 distinguish implemented local approval-order hardening from the still-unimplemented full-text-aware write-admission contract, including explicit destinations/mode and bound recovery outcomes.

Repository source audits advanced 25 → 27 of 76; 49 remain. Keyverse has protected identity contracts but no audited release. inkspan's historical immutable v0.3.1 lacks its relevant current contracts. Seven release-bearing candidates are not seven adopted libraries. Real steward decisions and independently approved labels remain separately 0/3715. This repair read no private campaign artifacts, called no Zotero/model, and produced no real label, approval, write or rollback.

Keep Draft behind the unchanged prerequisite chain. The September 6 pre-push all-PR audit found 32 open / 31 Draft / 36 unresolved threads and no current-head approvals in returned review evidence. New source heads require fresh hosted evidence. No force push, self-approval, dismissal, protection weakening, retarget, closure, protected merge or release was performed.

Earlier notes below retain historical coordinates and limits, not current acceptance evidence.

Prior PR description, retained without discarding evidence

Current checkpoint — 2026-09-05

Published documentation head: 6db1ca4ef909394a799b425ebaf48eab760b7b44; named base codex/zotero-fulltext-review-context at a41306a96f67388998c8c8bfdf24d70049bcf15a. Tested runtime: b9c250632d04794773d4436665299610f6f9892d. The final documentation commit changes no crates, Cargo manifest/lock or scripts relative to that runtime.

The earliest private reader/error belonged to ffa1150 in PR #29. Its separate committed diagnostic RED/GREEN 4c0c8f0 → 25d4a78 and metadata writer RED/GREEN cdf8e12 → 0837c6f now sit on that owner and propagate through ordinary PR #30–#38 parent merges. PR #28 first received the one-line inherited Clippy fixture repair 5c95bb7; PR #29's RED-only cleanup coverage branch was repaired in test-only fec97ac. No later full-text feature was reverse-merged into earlier owners. All old child heads and repaired parents remain ancestors; no PR delta was closed or discarded.

Final runtime passes 235 tests across 41 unfiltered suites (three doctests included), strict all-target Clippy, formatting, warnings-denied rustdoc, the CI contract, release build and the unchanged coverage gate. Nested filtered subprocess results are not counted twice. Coverage: 391/391 functions, 4,394/4,394 source-normalized regions, 728/728 normalized branch outcomes; raw LLVM 4,746/4,854 lines, 6,938/7,134 regions, 644/728 branches, not 100%. Independent source and saved-log review found no merge regression; one ADR wording inconsistency was corrected. This is not GitHub approval or hosted GREEN.

The 12:52:47 UTC census is 76 repositories, with 25 exact-default source audits and 51 remaining; six audited candidates have release source coordinates, with no authenticated asset or consumer adoption claim. New audits distinguish Psychometrics Commons, DiagramWeave, NewsDOM and two README-only owners. NewsDOM's v0.2.0/default mismatch was handed to the existing Naruon task without misidentifying it as the NewsDOM writer or opening a duplicate repair.

The earlier real artifact observations remain the last measured private checkpoint. No private campaign file was read or changed in this repair continuation; there were no model/Zotero requests, new predictions, labels, approval, write or rollback. Authentic decisions and independently approved labels remain separately 0/3,715; lifecycle capability metric stays 27. Existing raw-byte duplicate-key admission, full-envelope review binding, metadata-only 16 MiB writer guard and separate streaming capture remain intact.

Keep Draft behind #37 and the complete prerequisite stack; ADR 0006 remains Proposed. The fresh all-PR GraphQL audit failed with RATE_LIMIT before returning PR evidence. The last complete 12:39–12:40 UTC census is historical, not a current approval or check verdict after these pushes. Ruleset 18156473 was separately confirmed unchanged. No rate-limit workaround, force push, protection weakening, self-approval, dismissal, retarget, closure or protected merge occurred.

Exact measured baseline · Source inventory · Proposed ADR 0006

Preserved earlier description and historical checkpoints

Motivation

The retained-text view in #37 did not bind subsequent decisions and approval to the exact capture. This child preserves that evidence throughout private review without upgrading earlier metadata decisions or authorizing Zotero writes.

Proposal

• Create a separate versioned all-blank worksheet from a verified report and capture.
• Validate the entire completed view, recursively reject duplicate JSON keys before projection, and apply only decisions atomically. Changed evidence and stale views fail without overwriting earlier work.
• Reverify the complete capture/report relationship at finalization and evaluation; external governance receives the whole reviewed set and every label.
• Expose initialization, pending view, application and finalization through private commands that reuse the existing library contracts and file-admission helpers.
• Reserve per-row decision-edit headroom and enforce the inclusive 16 MiB metadata/review input and output ceiling. Capture retains its streaming writer and separate 512 MiB input ceiling; this is not a new serialized-capture output-size guarantee.
• Replace private JSON syntax/type diagnostics once at the shared reader, so unknown fields and rejected values cannot echo private source content. Artifact roles, size/growth errors and I/O failures remain distinguishable.
• Maintain PRD, TRD, Proposed ADR 0006, DDD/UML, threat model and aggregate evidence. Expand the ontology-owner inventory to 20/76 exact-default-source audits; 56 remain and the five release-bearing candidates are not adoption evidence.

Verification and preserved history

Published documentation head: 6dc5f3ca09729b5594130722d37af47d1bf30462.
Fully exercised runtime: 2fadbdaba3cd546f6c345ed4a950baef79325982.
The final documentation commit has no changes under crates, Cargo manifests/lock or scripts.

• Workspace test run passes; the exact inventory has 228 tests across 40 suites, including three doctests. The nested filtered subprocess is not counted twice.
• Strict Clippy, formatting, warnings-denied rustdoc, CI contract, release build and the existing coverage gate pass.
• Functions 387/387; source-normalized regions 4394/4394 and branches 728/728. Raw LLVM remains 4696/4804 lines, 6824/7020 regions and 644/728 branches, not 100%. No coverage exclusions added.
• Exact-size edit overflow: committed RED 35b7816 → repair e0744e0, preserving generation → longest-label edit → exact-boundary application.
• Metadata output overflow: RED 4aabc6ab59fc16447bfe9b78cb12aeb2997a0a9d → shared pre-create guard 351a0c88368e7ea07330de16ef3f5daa83661fd3. The one accidentally escaped existing fixture was independently restored in 0672ebe and ee9e263; ordinary merges preserve both histories and concurrent owner evidence 3c08a44919d4018da6da3d1e8f1cbf2b65007bbc.
• Actual private-command RED 0a70da9 failed three commands and a parser test while the existing two-batch library control passed; GREEN 2a92b710c574b1f79cb8f2cc0047fd3870c09b16 reuses that implementation.
• Private diagnostic disclosure: actual CLI/shared-reader unknown-field RED d3fdaa5 and independent invalid-disposition RED 3059c0e precede shared repair d5fda2028dbf1ef1d5b919c9e30d3b808ce88887. Earlier predecessor branches still require minimal backport and forward propagation before their own acceptance.
• Real offline blank initialization preserved all 3715 blank decisions and input hashes. The new pending-view command at the exercised runtime created a separate 1,590,742-byte single-link 0600 artifact in 2.22 s, maximum RSS 288,505,856 bytes.
• Independent artifact audit at 12:21:47.264 UTC verified unchanged inputs, capture identity and 25 blank pending rows: 21 with nonempty text and four without. Its bytes equal the earlier read-only view. This is reuse evidence, not increased full-text coverage or classification progress.

Non-goals and remaining gates

Authentic decisions and independently approved labels remain 0/3715. No new model/Zotero request, prediction, campaign decision, approval, mutation, deployed governance or immutable release is claimed. Application/finalization are tested with synthetic inputs only; finalization cannot issue or authenticate approval. There is no evaluator CLI or conversion into the separate write-admission contract.

The prerequisite #37 remains OPEN Draft at named base bdeaa19fe6281563dbb7a1387db43aadd1f5c5a2. Ordinary merges preserve every predecessor delta. Keep #38 Draft and ADR 0006 Proposed until protected prerequisite acceptance and independent exact-head review/check evidence exist. The 12:04:49 UTC COMMENTED review is not approval, and a CodeRabbit Draft skip is not hosted review success. Local verification is not protected-main shipment.

Alternatives

Optional legacy context fields permit silent downgrade; projecting completed JSON before owner validation loses duplicate keys. Raising parser ceilings would weaken an existing resource boundary. Per-command error sanitizers would leave sibling callers exposed. Existing review cores, file helpers and installed dependencies suffice; no new service, dependency, coverage exclusion or Utility Repository was added.

Measured baseline

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review found one bounded-artifact invariant gap in the private metadata CLI boundary. read_private_json rejects metadata artifacts above 16 MiB, but write_private_output previously created and flushed arbitrary in-memory metadata bytes. That allowed an owner-generated worksheet/review/finalization artifact to exceed the owner's own read contract and become unrestorable.

Committed regression 4aabc6ab59fc16447bfe9b78cb12aeb2997a0a9d supplies MAX_ARTIFACT_BYTES + 1 synthetic bytes and requires fail-closed InvalidData before the output path is created. Minimal production repair 351a0c88368e7ea07330de16ef3f5daa83661fd3 adds that pre-create bound to the shared metadata writer while leaving the separately bounded 512 MiB streaming full-text-capture path unchanged. The contents-API edit accidentally escaped one pre-existing JSON fixture; corrective successor ee9e263b59a7249460fc797f0d8a11203b3fa932 restores exactly that fixture line. Commit comparison confirms the corrective commit is one line and the net production delta after the RED is only the metadata writer guard/comment.

This is source/test repair evidence, not hosted current-head GREEN: no pull-request workflow run exists for ee9e263b59a7249460fc797f0d8a11203b3fa932 at this review. Keep ADR 0006 Proposed and the PR Draft; prerequisite #37, independent approval, and protected exact-head checks remain separate gates.