feat(policy): revalidate semantic-node authority at dispatch boundary

[seonghobae]

Current verified parent adoption

Exact #96 head cbabf55c6a25b979fa0d9e3c1677338665975ab7 adopts #95 6b29d890245ed2f612c2998198f4e8c8a06da312 through ordinary merge ced1765f. Test-first 4144725f reproduced a replacement connection completing the original field observation. The inherited sealed-reply repair rejects foreign success/error/exception replies, preserves pending work and allows the original connection to complete its own request.

The entire original child policy crate, including dispatch revalidation and its three tests, is byte-identical to prior #96. Core, network and workflows are byte-identical to current #95. Node validation still precedes the callback; adapter failures remain distinct from authority failures, and callback completion is not outcome proof. No new production logic or workflow change was introduced by this adoption.

At the exact head: six focused Rust tests, 151 Python contracts, complete workspace Rust tests, fmt, all-target check, strict Clippy, dependency-inclusive warnings-denied rustdoc, compileall, CodeGraph and diff checks passed. Production coverage is 100%: 1,410 functions,14,908 lines,19,030 regions,1,552 branches. Coverage artifact SHA-256: f69829e1968a75c8d3c8ea7d08df87669d47a7d6adfbbb88d08d9bb0d384b10d. Independent read-only review found no actionable issues; not a formal approval.

Actual Microsoft Edge visual inspection of generated API documentation at 1440×1500 confirmed readable current-authority and dispatch sections with cross-crate links rendered and no observed clipping or overlap. Documentation presentation is not product-browser acceptance.

Keep Draft while prerequisites remain active. New exact-head GitHub checks must complete independently. No merge, package publication, tag or release is claimed.

Historical predecessor evidence

Partial implementation of #28, stacked on current #95.

Current stack

Exact live prerequisite #95 is 97aa0f2e340ee6fd920d0418f97af276b190554f; exact #96 head is b7ba8dd1433410cee43084a73e31816da841b2a2. The non-force restack preserves only #96-owned PolicyAuthorizedSemanticNodeAction::dispatch_if_current behavior and its focused tests relative to the parent.

Contract

dispatch_if_current validates the retained registry-issued node against the trusted adapter registry before invoking one callback. After document advance removes admission, it fails closed as NotAdmitted and never calls the adapter. Adapter failure remains distinct from authority failure, and callback completion is not post-condition proof or additional authority.

Exact-current evidence

At exact head b7ba8dd1433410cee43084a73e31816da841b2a2, test-first RED reproduced the stale inherited diagnostic and the missing durable documentation boundary. Local verification passed 143 Python contracts; locked Rust format, check, all-target tests, strict Clippy, and rustdoc; exact 100% production function, line, region, and branch coverage. Hosted exact-head checks remain non-passing until terminal success.

Keep Draft while #95 and its upstream stack remain active. No self-approval, force-push, destructive rebase, workflow/ruleset/secret mutation, gate weakening, release, or predecessor-evidence transfer is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Restacked non-destructively on PR #95 exact head 5ae19913b2a1281a2fef83f22f2bdcdfa7c6d5f9; new exact head is 9117aabd60f1504018f5a3393bfefb369395884c. The semantic diff remains only the policy dispatch revalidation method and its tests. Local verification: 139 Python contracts; fmt; strict Clippy; rustdoc; full locked workspace tests; exact workspace LLVM function/line/region/branch coverage all pass at 100%. One inherited macOS socket-timeout cleanup test first returned transient EINVAL; the exact test, its complete test binary, and the full workspace rerun all passed immediately without source changes.

[seonghobae]

Restacked non-destructively on exact current #95 97aa0f2e340ee6fd920d0418f97af276b190554f; new #96 exact head is b7ba8dd1433410cee43084a73e31816da841b2a2. The focused RED showed the inherited stale-document expectation no longer matched current registry semantics; it now fails closed as NotAdmitted, never invokes the adapter callback, and has a durable traceability contract. Exact-head local verification passed 143 Python contracts, all locked Rust gates, and exact 100% production function/line/region/branch coverage. Hosted checks remain pending and are not claimed as passing.

[seonghobae]

Writer lease RELEASED — root task01a06c0f-b427-7830-b654-9addcdfe7aff. Published/readback #96 cbabf55 on #95 6b29d89; body matches. Six focused Rust tests,151Python,fullworkspace stable gates,strictdependency-inclusive rustdoc,compileall,CodeGraph,diff passed. Coverage1410functions14908lines19030regions1552branches all100%, SHA256 f69829e1968a75c8d3c8ea7d08df87669d47a7d6adfbbb88d08d9bb0d384b10d. Independent read-only review nofindings,notapproval. Childpolicy/three original tests and parentcore/network/workflows byte-identical. ActualEdge /tmp/pr96-rustdoc-cbabf55c.png inspected, allauthority/dispatch content andcrosscratelinks readable. Alllocalprocesses terminal. CI34081979602 Rust101618863219/coverage101618863130 QUEUED,notacceptance. Sourcewriter released; existing coverageartifact/results preserved. Nextsafe work: #238 bounded publication checkpoint for #93/#95/#96, statusreceipts and release-readiness evidence. User-requested AGENTS lessons alreadypublished #238de06d65e with197Python/visual/review; deployment not performed because release prerequisites remain unmet. No merge/tag/release/secret/workflow/gate changes.