fix(reputation): reject stale decision envelopes at live admission

[seonghobae]

Security gap

Proposed #173 requires protected execution to reject replay and bind continuation to decision expiry. The pure contract keeps DecisionEnvelopeV1::validate() as structural/archival validation; live consumers need one canonical injected-time admission check rather than duplicated or omitted freshness logic.

This Draft child owns only that Wardnet live decision-freshness contract. It performs no HTTP, URL parsing, DNS, peer validation, redirect/proxy/TLS behavior, ambient clock I/O or executable EgressWeave transport authorization.

Executed RED → minimal GREEN

Exact head 76fa9a0e23a68853f5fa14c6cd9bad10a4b51a7b acquired a real hosted runner in focused run 34093010158 / job 101650328620; exact checkout and formatting succeeded, then decision_freshness failed because the live-use API did not exist. This is the causal RED.

Minimal production GREEN 4a88e8a7f4b324c2593f3b1a4aa3e5d791fe80e9 adds a separate DecisionEnvelopeV1::validate_at(now_unix) path: structural validation runs first, then live admission rejects evaluation in the future or after expiry while keeping both endpoints inclusive. The pure core acquires no environment/runtime authority. A distinct live-validation error preserves structural-contract errors versus outside-validity-window failures.

Parent adoption and current exact state — 2026-09-08 KST

Parent #176 advanced through additional test-only fixture repairs to exact 5d7166da2034d450f37ab69d37fbbb9d1301e287. This child adopted that complete parent movement non-force rather than duplicating the fixture fixes or treating the concurrent push as a race.

PR #178 remains open/Draft and mergeable with base exactly #176@5d7166da2034d450f37ab69d37fbbb9d1301e287; current head is unchanged 43faf199fde4a74a1f74a3c544f56f5f4e3b23e5. Its unique semantic ownership remains the decision-freshness source/docs/tests.

Fresh exact-current repository evidence now supersedes the earlier queued snapshot: CI 34130786226 is terminal SUCCESS and Fuzz 34130786225 is terminal SUCCESS on exact 43faf199.... Those results prove this Draft child on its current stacked parent only. They do not make it independently mergeable, do not transfer across parent integration, and do not substitute for the complete security/review/governance gate set that must materialize after the root stack reaches protected truth.

Child #179 is stacked on this exact head and must preserve only its evidence-snapshot delta. Root #175 and parent #176 must integrate through ordinary protected governance first; after any protected-parent movement, this child is reconstructed/adopted non-force and revalidated from scratch.

EgressWeave remains canonical for executable URL/address/DNS/peer/redirect/proxy/TLS/resource authorization. Decision authenticity, transport enforcement and any replay-resistant durable store are not manufactured by this contract. No self/model approval, routine administrator bypass, force push/destructive rebase, gate weakening, mutable foreign dependency or predecessor-evidence transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}