feat(core): implement bounded semantic crawl frontier

[seonghobae]

Purpose and current source

Implement Veilpick's first Rust acquisition-planning primitive under ADR 0003 without duplicating OriginWeave transport/browser authority.

• exact current head: 556b30b9eaac083ccb52cd6c5193411df0fb81e8;
• current documentation base: PR docs(adr): define ontology, autonomy, stealth and ecosystem boundaries #1 / docs/adr-challenge-resolution@a1cf6cf2e239b0657376890f0631267ea01b28f2;
• ancestry: ordinary non-force merge commits preserve the original implementation head 30bb16417c42f0478200b9ce2dade2bcd0d53c64 and current documentation head a1cf6cf2e239b0657376890f0631267ea01b28f2;
• compare against the current documentation head: ahead 6 / behind 0, with that head as the exact merge base;
• GitHub reports mechanically mergeable;
• lifecycle remains Draft / Proposed.

This is no longer interface-only scaffolding. src/frontier.rs contains the production implementation and src/lib.rs exports Candidate, FrontierLimits, FrontierError, FrontierStep, and CrawlFrontier. The complete product remains unshipped.

Implemented source behavior

• Validated immutable candidate IDs and concept hints: 1..=256 UTF-8 bytes per identifier, no Unicode whitespace/control characters, at most 128 raw concept entries before deduplication.
• Explicit concept-priority ordering and stable FIFO ties through BTreeMap<(Reverse<usize>, usize), Candidate>.
• Lifetime BTreeSet deduplication, including dispatched targets; duplicates never replace or reprioritize the first admitted candidate.
• Lifetime admission and dispatch limits in 1..=4096; draining/refilling does not reset attempts or the seen ledger.
• Unknown concepts are checked before duplicate/capacity shortcuts; returned errors leave state unchanged.
• Order keys derive from lifetime admission count rather than pending length, preventing interleaved dispatch/enqueue from overwriting pending work.
• Count-only Debug output and static error messages avoid reflecting opaque identifiers or concepts.
• Explicit Candidate / Drained / BudgetExhausted outcomes, none of which certifies completed collection.

Targets are opaque acquisition references. Dispatches are not HTTP requests, authorization grants, ontology reasoning, or evidence of extraction. Stealth and supported-class automated challenge resolution remain mandatory product requirements and are not supplied by this slice.

README integration

The dependent README now carries every valid public-surface delta from PR #1 while preserving this branch's source-current Rust slice:

• user problem and intended authorized acquisition experience;
• architecture-only versus pre-release implementation status;
• truthful source-only quickstart and the exact frontier commands;
• product/non-goal and ecosystem integration boundaries;
• quality/release gates, product-technical gap continuation, documentation, support, security-reporting, and Apache-2.0 scope;
• explicit separation of the frontier planning primitive from full-product evidence.

No standalone README writer or force-restack was created.

Tests and example

Preserve the original 12 test requirements byte-for-byte and add 13 tests in tests/frontier_boundaries.rs (25 definitions total). Additional cases include Unicode byte limits, exact identity, duplicate goal/hint handling, interleaved scheduling, refill exhaustion, 81 small priority combinations against a separate sorted oracle, the full 4,096-target boundary, and diagnostic privacy.

examples/frontier.rs demonstrates synthetic local planning only. README, CHANGELOG, the implementation plan, and docs/verification/semantic-frontier.md record the actual source and evidence boundary.

Verification evidence

Predecessor 30bb16417c42f0478200b9ce2dade2bcd0d53c64 recorded nine grouped static checks and exact staged-blob matching. Those checks were not Rust compiler, test, rustfmt, Clippy, or rustdoc success; the authoring environment lacked cargo/rustc and official download attempts did not succeed.

Current head 556b30b9eaac083ccb52cd6c5193411df0fb81e8 was verified structurally after publication:

• all non-force merge parents are retained;
• PR docs(adr): define ontology, autonomy, stealth and ecosystem boundaries #1 head is the exact merge base;
• ahead 6 / behind 0;
• README contains both the public product narrative and frontier source/command contract;
• unresolved inline review threads: zero;
• GitHub reports mechanically mergeable.

All predecessor-hosted evidence is historical after the merge commit. New exact-head CI, Rust, security, SAST, CodeQL, Noema, OpenCode, and admission results must complete on 4361ff6… before readiness changes.

Dependency, license, and merge boundary

This PR remains stacked on documentation PR #1. PR #1 must integrate first through ordinary governance; then this PR must be retargeted to the actual protected integration revision and revalidated without rewriting history.

The root Apache License 2.0 predates this slice. Cargo.toml declares Apache-2.0 and Cargo.lock introduces no external package because the frontier is standard-library-only. Future dependencies and external services retain their own terms.

No external runtime dependency, force push, self-approval, gate weakening, merge, release, or scheduled/background work is introduced. Keep Draft until exact-head Rust/compiler/test/format/lint/docs and required governance evidence are terminal-success and every valid finding is repaired.

Current exact authority — 2026-09-07

• stacked base: docs/adr-challenge-resolution@a1cf6cf2e239b0657376890f0631267ea01b28f2;
• exact current head: 556b30b9eaac083ccb52cd6c5193411df0fb81e8;
• ordinary non-force integration preserves the complete current docs(adr): define ontology, autonomy, stealth and ecosystem boundaries #1 README/ADR delta, including the typed authority/retry/capability contracts, and the Rust frontier implementation;
• compare against the exact stacked base: ahead 6, behind 0;
• GitHub reports open, Draft, and mechanically mergeable;
• unresolved inline review threads: zero;
• the new exact-head Rust verification is queued; predecessor results do not transfer.

Latest parent integration

Exact head 556b30b9eaac083ccb52cd6c5193411df0fb81e8 is a non-force two-parent merge of README/ADR authority a1cf6cf2e239b0657376890f0631267ea01b28f2. It preserves the semantic-frontier implementation while carrying the cancellation-boundary review repair. Earlier hosted evidence is superseded.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Execution receipt for exact test-only head 26d94719943892b619349a4a0e0835c4cf5a46d4

The committed nine-file slice was read back through Git tree 905df7d40987ee20e5425ee6f9881b12c760eaf4; each changed blob matches its locally inspected copy. Local checks covered TOML/YAML parsing, read-only workflow permissions, non-persisted checkout credentials, twelve test definitions, newline integrity, and absence of a frontier implementation.

The actual Rust push workflow has materialized: run 33948681099, job 101259264294, exact source 26d9471. Latest read returns status=queued, runner_id=0, and steps=[]. This proves workflow admission only, not compiler execution, product RED, test success, or release readiness. The same-repository PR duplicate is not the authoritative execution lane.

Local cargo test --locked --all-targets exited 127 because the authoring container has no Cargo/Rust compiler. Download-host resolution failed there as well. Those are authoring-environment diagnostics, not a failing product regression.

The production frontier has not been written. Keep Draft. The next valid step is to observe the intended unresolved-API RED on this unchanged test-first head, then implement the bounded frontier and obtain fresh tests/fmt/Clippy/rustdoc evidence. No self-approval, merge, force update, or background completion claim is made.

[seonghobae]

@codex review

Please review exact implementation head 30bb16417c42f0478200b9ce2dade2bcd0d53c64 against test-only predecessor 26d94719943892b619349a4a0e0835c4cf5a46d4 under ADR 0003 and docs/superpowers/plans/2026-09-05-semantic-frontier.md.

Focus on input validation and non-mutating rejection, lifetime identity/dispatch budgets, stable priority and FIFO ordering under interleaved enqueue/dispatch, count-only diagnostics, and the distinction between planning outcomes and successful collection. The original 12 tests are retained; 13 boundary tests and a synthetic example were added. No transport, browser, model, workflow, or dependency changes accompany the implementation.

Execution evidence remains unavailable: local Rust commands exited 127 (Cargo absent), and the fresh exact-head push run 33949774109 is queued. The tests are defined, not reported passing; static inspection and blob identity are not a verified RED/GREEN cycle. Keep Draft; no merge or formal approval is requested by this comment.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.