feat(evidence): bind deterministic capture manifest identity

[seonghobae]

Partial implementation of #199, stacked on exact live PR #217 head c11e7333557007373a8178b4ca5e742040f1c508.

This Draft owns the next bounded structured-result-manifest identity boundary after extraction schema admission, immutable WARC records, and WARC/PROV binding. CaptureManifest deterministically binds the complete extraction-schema contract, exact WARC serialization identity, exact PROV JSON-LD identity, one non-null OriginWeave software revision, canonical record ordering, bounded record count, deterministic offline re-verification, exact persisted manifest bytes, and schema-bound structured-value digests that refer only to admitted WARC source records. The manifest remains payload-free and grants no capture, persistence, retention, browser, network, model, secret, signing, or release authority.

Test-first repair lineage

The original persisted-manifest repair added an exact-byte verifier after a semantic RED proved that CaptureManifest::verify_serialized_json did not exist. The verifier compares candidate bytes only with CaptureManifest::to_json() and deliberately does not parse or normalize JSON, so whitespace or other serialization drift fails as CaptureManifestVerificationError::IdentityMismatch.

A later structured-value extension exposed a new exact-coverage defect on exact head 2c4d0d3d6f9aa6b75a185f3cfaf03edae271febc. CI 32841640034 failed production coverage at 524/524 functions, 4488/4504 lines, 5599/5632 regions, and 641/645 branches. This was actionable evidence, not a passing partial result.

The same canonical branch was repaired test-first without changing production authority semantics:

• 0b104d7dd7adf128f58a8922ed02fde8bda9b77b added deterministic standard-error and hostile field/digest boundary regressions. CI 32869695159 improved coverage to 4504/4504 lines, 644/645 branches, and 5630/5632 regions, while also exposing canonical rustfmt drift.
• a012cb867ae841bf80a0f4977735a92e3be8ff00 canonicalized the regression and added an all-digit valid SHA-256 case to execute the remaining digest branch. CI 32870271382 reached 100% functions/lines/branches but still reported 5630/5632 regions.
• Exact artifact inspection localized the final two executable regions to fail-closed propagation of an invalid candidate through CaptureManifest::new_with_warc_values and verify_with_warc_values. Current head 649e30e19c3b9356061ef806d2b8e9b9b6e3ba8e adds a realistic empty-record verification regression that drives that production error propagation without catch-all handling or production weakening.

Exact-current evidence

The unchanged current contributor head is 649e30e19c3b9356061ef806d2b8e9b9b6e3ba8e, with live base c11e7333557007373a8178b4ca5e742040f1c508.

On this exact head:

• CI run 32870842777: success;
• Rust contracts job 97877182875: exact checkout of 649e30e19c3b9356061ef806d2b8e9b9b6e3ba8e; repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success under the repository Rust 1.97.1 contract;
• Production coverage job 97877182750: success;
• exact owned-production verifier result: functions, lines, regions, and branches all 100% covered;
• exact coverage artifact exact-coverage-649e30e19c3b9356061ef806d2b8e9b9b6e3ba8e: artifact ID 9572036743, ZIP SHA-256 03f9a3f5a2e1ad03360576a8124a170cd55079281d04ac0e09724dabc2174a04.

The exact-current workflow inventory exposes CI only for this stacked head. SAST, Security Scan, and Manifest V3 evidence are therefore absent, not passing, and predecessor evidence is not promoted. Current formal-review and inline-review-thread inventories are empty at the latest refetch; no independent approval is claimed or inferred.

No predecessor check or review transfers to this branch. It remains Draft and dependency-bound on #217. Protected-main AGENTS.md remains authoritative; this scheduled actor does not merge, self-approve, tag, publish, mutate workflows, add secrets, or weaken gates.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}