feat(evidence): bind WARC records to PROV JSON-LD

[seonghobae]

Partial implementation of #199, stacked on exact current PR #210 head 529d11a3571f6b1834b9baa49ef67eb08f043978.

Buyer-visible boundary

This Draft implements the next evidence-native replay boundary after schema admission and immutable WARC resource records: a bounded deterministic W3C PROV-O JSON-LD bundle that binds one already-validated WARC record to its verified source entity, one capture activity, the exact OriginWeave software revision, explicit WARC payload-completeness state, the retained payload block digest, and a SHA-256 digest of the complete deterministic WARC serialization. Raw WARC payload bytes are not embedded in the provenance document.

The in-memory bundle also exposes deterministic offline verification against a candidate validated WarcResourceRecord. Verification binds the complete validated ProvenanceRecord together with WARC identity, capture time, payload digest, completeness state, and serialized-record digest. The compact JSON-LD projection exposes source URL/hash rather than claiming that serialized JSON alone preserves every internal provenance dimension.

Test-first defect lineage retained by this head

The canonical branch previously repaired four concrete integrity gaps with RED regressions before production changes:

• preserve WARC complete/truncated state, including the exact standard truncation reason;
• distinguish different deterministic WARC serializations even when payload digest and selected metadata match, by binding a SHA-256 digest of the complete serialized record;
• provide typed fail-closed verify_record(&WarcResourceRecord) offline verification; and
• compare the complete validated provenance object so source locator/channel drift cannot pass merely because WARC bytes, source URL, and source digest match.

It also rejects Git's forty-zero zero-id sentinel as a software revision instead of emitting it as an immutable OriginWeave commit identity. Historical RED/intermediate/predecessor heads remain regression lineage only and are not current passing evidence.

Current stack realignment

PR #210 advanced from the prior #217 merge base 597f3a653f2169364e82cb29fbf150af4bfe2e8c to exact head 529d11a3571f6b1834b9baa49ef67eb08f043978, itself realigned on current #209. The previous #217 head bb7fb7604c713fe0cc46508a8e296df3c036bce9 was therefore 7 commits behind its live parent.

Current #217 head 56fcfa56525e4f2e980e0ee05b6776d621bcddc5 is a non-destructive two-parent stack-realignment commit over that prior child head and exact #210 head. The parent-owned extraction-schema source/tests and ADR 0106 blob are inherited exactly from #210; the child-unique PROV/WARC-bundle files remain intact. No force-push or destructive rebase was used.

Fresh ancestry comparison reports #217 ahead of exact #210 with 0 commits behind, with merge base exactly 529d11a3571f6b1834b9baa49ef67eb08f043978. No predecessor check or coverage result transfers to this head.

Exact-current verification

Protected main is b05d5acca82b9d916ada2c8e82f59f92a89817e1. On unchanged exact head 56fcfa56525e4f2e980e0ee05b6776d621bcddc5:

• CI run 32631120166: success;
• Rust contracts job 97173990958: repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc success;
• Production coverage job 97173991121: exact checkout of 56fcfa56525e4f2e980e0ee05b6776d621bcddc5 and owned-production enforcement success;
• verifier output: production functions, lines, regions, and branches are 100% covered;
• exact coverage artifact exact-coverage-56fcfa56525e4f2e980e0ee05b6776d621bcddc5: artifact ID 9491084315, uploaded ZIP SHA-256 f9fd3894de6a0513d9f7ba15e29fd42626a1ad5df27abf3042c6a859d0746e0f;
• formal review inventory: none; and
• inline review-thread inventory: none.

The same-head workflow inventory currently returns CI only. SAST / Security Scan / Manifest V3 success is therefore absent and is not claimed for this stacked head. No independent approval is claimed or inferred.

Keep this PR Draft while prerequisite #210 remains Draft and #209 remains active.

Standards and authority boundary

The non-null Git identity rule follows Git's protocol distinction between an ordinary object identifier and the forty-zero sentinel used for absent/create/delete reference state. This constraint does not authenticate GitHub or establish trust/reachability of the named commit.

This slice is provenance representation and deterministic consistency verification only. It does not authenticate the producer, cryptographically sign the record, establish factual correctness, persist WARC/PROV, authorize capture/retention/export, contact a live source, execute replay or active content, or grant browser/network/secret/model authority. The compact JSON-LD projection does not serialize internal source locator/channel, so serialized JSON alone is not proof of those internal dimensions.

No workflow, secret, governance, release, tag, publish, approval, Ready-state, or merge mutation is included.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}