feat(reputation): add versioned outbound reputation contracts

[seonghobae]

Scope

Starts the first Wardnet-owned outbound destination-reputation implementation slice from protected main@a52ccd0a24a727d9349bb32def7713882d8cad1e.

This PR remains Draft. It adds a pure Rust, transport-neutral contract core for Wardnet's destination maliciousness / SOC evidence bounded context. It does not implement outbound transport authorization, DNS resolution, redirect/proxy/TLS policy, browser acquisition, sandbox execution, provider fetching, cross-service SQL, or mutable sibling dependencies. Executable egress authority remains with EgressWeave; this crate consumes canonical destination subjects rather than reparsing network syntax.

RED -> causal GREEN

The initial hostile contract slice covers unsupported schema/wrong direction, blank authenticated workload or purpose, ambiguous non-host subdomain scope, protect policy without required authorities, invalid evidence time/confidence, empty source eligibility, and stable exact-host fixture round-trip. The earliest temporary pull_request rescue runs used default checkout and therefore exercised GitHub's synthetic merge ref; they are retained only as candidate-base causal evidence, not exact source-head evidence.

A later review found that DecisionEnvelopeV1 did not bind a decision to authenticated DestinationContextV1 or immutable evidence_generation; the contract now carries and validates both. Older rescue runs for that finding also used the synthetic PR merge ref, so they remain causal candidate-base evidence only.

Evidence lifecycle review then found that EvidenceRecordV1::validate_at() accepted enforcement_eligible=true evidence with provenance_refs=[]. Exact-source RED 85770857c0f8a5bff21dd7722960209e45b19d5f, run 34018925748 / job 101447782353, explicitly checked out/asserted that SHA, passed formatting, and failed only rejects_enforcement_evidence_without_provenance. Minimum fix 71086b18d7f3cf91f1e9952a9183af6f43874811 rejects it with typed MissingEnforcementProvenance; exact-source run 34019072047 / job 101448177910 verified that SHA and passed all 8 contract tests plus the two then-existing decision-binding tests. The temporary workflow was removed.

A subsequent review found the decision-side analogue: an adverse known_malicious or suspicious decision could validate with evidence_refs=[]. An initial structural harness commit 3d83ec71cba2e9e10f1b6078729cc34acf6fd070 failed compile before the intended typed error existed and is not used as semantic RED. Executable exact-source RED ba962a105d9e38f48cd9df206733314fd2a4b56c, run 34019322175 / job 101448849227, passed exact SHA assertion and formatting; all 8 contract tests plus two prior binding tests passed; only decision_envelope_rejects_untraceable_adverse_assessment failed because validation returned success. Minimum fix ef8fed6edf65b14389703130000bad4769eafe4a requires nonempty evidence refs for adverse assessments and returns typed MissingDecisionEvidence; unknown still permits the absence of adverse evidence. Exact-source run 34019401076 / job 101449062125 asserted that SHA and passed fmt, all 8 contract tests and all 3 binding tests. The temporary workflow was removed in cleanup 56292904fddbb249212c54758def26ff72b801c3.

The next security review checked assessment/action consistency against the design's protect precedence. DecisionEnvelopeV1 still accepted assessment=known_malicious, valid adverse evidence, and action=allow, which could serialize a hard-threat assessment as a positive reputation gate. Exact-source RED 7e33ee8c0086073faf1f8c4bb8cd9df62ceec5da, run 34019672058 / job 101449796560, explicitly checked out/asserted that SHA, passed formatting and all 8 contract tests plus the three prior binding tests, and failed only decision_envelope_rejects_known_malicious_allow. Minimum fix 94c0ddeae6750ed4d2033b859be3472a746d03ed treats any adverse (known_malicious or suspicious) assessment paired with allow as typed UnsafeAdverseAllow, while preserving the separate transport-authorization boundary. Exact-source run 34019753543 / job 101450021347 passed exact SHA assertion, formatting, all contract tests and all four decision-binding regressions. The purpose-complete rescue workflow was removed in cleanup d34cc92be22366b8e18e6a203bc6455eef52c1b1.

All predecessor exact-source GREEN runs above are causal evidence only. Normal repository CI/security/coverage/review evidence must be reacquired on the current cleanup head before readiness or merge.

Contract boundary

• Wardnet owns destination maliciousness/reputation assessment, reviewed evidence/source-policy contracts, policy result/reason, evidence health, request/evidence identity binding, enforcement-evidence provenance, adverse-decision evidence traceability, fail-closed adverse action semantics, and SOC-facing evidence semantics.
• DestinationSubjectV1 is already-canonical input from its owning canonicalization boundary; this crate does not claim DNS/URL/IP/TLS canonicalization authority.
• A Wardnet reputation Allow is not executable transport authorization and cannot override an EgressWeave denial.
• Evidence producer severity/confidence is preserved as producer metadata rather than manufactured into a Wardnet probability.
• Policy and evidence clocks are injected contract data; this pure core performs no network/source acquisition.

Repository / owner discipline

• No edit to docs/product-technical-gap-baseline.md; docs(gaps): add exact-head readiness baseline #130 remains its sole writer.
• No foreign-owner source or PR-state mutation.
• No dependency on mutable context-graph-contracts, EA, EgressWeave, quarantine, contextual-orchestrator, or appguardrail source.
• EgressWeave #237 remains the owner path for an immutable Rust-consumable executable egress-authorization boundary; fresh GitHub Releases inventory remains empty.
• Context Graph Contracts and EA Core also had no immutable GitHub Releases at the current inventory, so this PR does not claim released Context Assertion/EA projection compatibility.
• No release, deployment, protect-mode enablement, transport-enforcement claim, self-approval, routine bypass, or predecessor-evidence transfer is authorized from this Draft.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head repair after fresh Task-1 contract review:

DecisionEnvelopeV1 still allowed a serialized reputation allow while required evidence health was expired or unavailable. That contradicts the proposed protect-mode precedence and REP-12 acceptance: required-authority/evidence outage must fail closed and cannot yield a grant-like reputation result.

Hostile regression commit 913cf4e9c1589dff96bb68a00463ac8e8f61fa59 adds decision_envelope_rejects_unavailable_required_authority_allow. Minimum source repair 414fb98743c729f4a4897f343a7f158882a9a598 rejects Expired|Unavailable + Allow with typed UnsafeUnhealthyEvidenceAllow; the causal source delta from RED commit to fix is only crates/wardnet-reputation-core/src/model.rs (+9/-0). It does not add transport/DNS/redirect/proxy/TLS authority or foreign dependencies.

Normal exact-current workflows have materialized but are non-passing: CI 34020602687 / rust job 101452371064, Security 34020602775, Semgrep 34020602706, CodeQL 34020602854, and Fuzz 34020602764 are queued. The CI job remains pre-checkout with steps=[], explicit ubuntu-24.04, and no runner identity; exact evidence was handed to .github#712. No predecessor GREEN is promoted and this PR remains Draft.