feat(email-writing): add hardened contextual-orchestrator boundary

[seonghobae]

Scope

This Draft PR implements Task 5 only: Naruon's hardened, provider-neutral contextual-orchestrator boundary plus owner-scoped orchestration configuration. It excludes Candidate/Judge admission, review API, Inkspan editor integration, send/publish behavior, calibration policy, and release behavior.

Security/privacy behavior retained includes authenticated owner-scoped configuration, encrypted inference credentials, bare-HTTPS-origin and DNS validation, pinned-address transport, redirect denial, DNS-rebinding checks, bounded request/response/trace/cardinality/retry/circuit state, strict JSON handling, redacted stable errors, and bounded Judge worker-lane lifecycle. Browser input never becomes endpoint/credential/provider authority.

Current stack state

Direct parent #1329 is 64d1f746723616b0111eb40b130d6f07ed413a86. Current Task-5 head is beb28466573b2163df97b027a6d3ac3776773869. No force-push or destructive rebase was used.

The unique Task-5 delta remains the orchestration TDD workflows, owner-scoped config migration/API/model/scope wiring, contextual-orchestrator client/port, required application wiring, and focused hardening/coverage tests. Root design documents are inherited through the stack and are not Task-5-owned semantic delta.

Current causal repair

Task-7 predecessor head a2c07ea13f5503b1877461ff0477e6e5f0528a59 eventually acquired a Python 3.14 runner after its --noconftest isolation change. Collection then failed before Judge tests because importing services.email_writing_orchestrator_port runtime-imported services.contextual_orchestrator_client, which transitively materialized core.config.settings and required application DATABASE_URL merely to import the Task-5 port.

That is a Task-5 dependency-direction/import-side-effect defect, not a Task-7 test defect. The repair is test-first:

• RED commit a08ef0b7f3dc95f69af4bb21a742de92eea587b4 adds a subprocess architecture regression that removes DATABASE_URL, imports the port, and requires the concrete contextual-orchestrator adapter and core.config not to materialize;
• causal fix/current head beb28466573b2163df97b027a6d3ac3776773869 moves concrete adapter/type imports behind TYPE_CHECKING, keeping the domain-facing port config-free at runtime while retaining the static typing boundary.

No DATABASE_URL workflow bootstrap, PYTHONPATH workaround, or Task-7 conftest restoration was introduced.

Authority boundary

contextual-orchestrator remains read-only to this writer and owns provider-neutral routing/test-time compute allocation. Naruon owns the authorized transport/configuration boundary and workflow policy around it. No deterministic keyword/regex semantic fallback is permitted; upstream failure produces typed unavailability/abstention rather than a lexical substitute.

Evidence and continuation

For exact current head beb28466573b2163df97b027a6d3ac3776773869, task5-contracts job 100235583025 / run 33626560905 and regressions job 100235582463 / run 33626560809 are currently queued before executed steps. They are non-passing. Central runner acquisition is tracked through .github#712; the leaf head is not churned merely to retrigger it.

The repaired ancestry has been ordinarily propagated without force to current task-owned descendants:

• feat(email-writing): parse contextual review candidates #1375 Candidate: 6a37753c86959ae07e6257496658ea4ae17f513c;
• feat(email-writing): restack independent Judge on current candidate #1524 Judge: ad888235577ba87f32d96e06fab1cfb9992d84a9;
• feat(email-writing): add versioned Judge admission policy #1530 policy: 32c7e33c304d1b500ddc230044e2877edcf411c8;
• feat(email-writing): compose bounded judged review service #1535 review service: c958b9964f925b6dca99e4c2c4db671934511a40;
• feat(email-writing): expose bounded advisory review API #1536 review API: 4c14771acddd150f59b5ce0888d15bae49686b0c.

External Cursor #1402 remains separately read-only at 3d6b3341c5dd15512d5d60cd5f8d95a1bbc6d846 and is not writable ancestry.

Fresh immutable dependency evidence still shows fast-mlsirm v0.9.1 at tag commit 09f762ded35786dd1078222a4577ff09d649816f with required public Judge symbols in tagged source, but its GitHub release has no attached distributable asset. Runtime import remains gated on an approved immutable distributable/package source, artifact hash and provenance, Python 3.14 compatibility, and Naruon's canonical hash lock.

Merge boundary

Keep Draft while current-head evidence is regenerated. Merge only on an unchanged head satisfying live rulesets/protection, every applicable exact-head gate, zero valid unresolved findings, and any qualifying independent approval actually required after the last push. Pending/queued/skipped-required/cancelled/neutral/failed/absent/stale/predecessor/synthetic/model-only/status-only/author-only evidence is non-passing.

No user-facing writing guidance is shipped by this orchestration-boundary slice; editing and sending remain available.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

@coderabbitai review

Please review the unchanged exact current head 9cd9b953a2dd236aebe1fcdc25e59ba3e9388505 (normal merge of live parent #1329 4570747c). Predecessor 0c0ac2b5 evidence does not transfer. Local Task 5: 70 passed, 100% coverage. Write-capable promotion/finalize workflows stay absent. Keep Draft. This comment is not an approval.

[coderabbitai]

@seonghobae I will review the exact current head 9cd9b953a2dd236aebe1fcdc25e59ba3e9388505. I will treat predecessor-head evidence as non-passing. I will keep the PR Draft status unchanged.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.