test(reputation): bind snapshot records to exact source generation

[seonghobae]

Refs #182. Draft child of #179.

Security finding

Exact parent #179@6305284dd3bc9cca5e0d8da3927abf7d5ea075b8 advertises immutable SourceSnapshotV1.source_generation, but included records were associated with a completed source snapshot only by stable source_id. A record received before completion could therefore be represented inside a later completed generation even when it actually belonged to an older generation; the aggregate wire shape could not prove exact-generation membership.

This is Wardnet evidence/provenance authority only. It adds no source fetching, transport authorization, URL/DNS/peer/redirect/proxy/TLS behavior, persistence, Context Graph mutation, or foreign-owner code.

Hostile RED — exact generation membership

Exact test-only head 8246d42952e9447480280690647ebe23d3695d65 changed only crates/wardnet-reputation-core/tests/evidence_source_generation.rs; production was unchanged from #179. The hostile fixture declares completed source generation source-generation-43 while wrapping an otherwise valid earlier-received record as belonging to source-generation-42. A control case binds the record to generation 43 and must remain valid.

CI 34147000138, rust job 101821082209, acquired GitHub-hosted ubuntu-24.04. Checkout/toolchain/fmt succeeded; locked workspace Test failed on the hostile fixture and Clippy was skipped. That is the required semantic RED against unchanged production.

Minimal generation-binding repair

Candidate f89e66260327781ed2e57f2390086c57e2e9f780 retained the RED unchanged and added explicit EvidenceSnapshotRecordV1 { source_generation, record } membership plus fixture migration. CI 34148525550 failed only at deterministic rustfmt layout before tests. b5f9af4ff88c83d104a66737681a70bb26452654 corrected only that formatting.

Validation delegates existing schema/text/list/source uniqueness/record/completion-order/duplicate-record checks to the pre-existing aggregate validator, then adds only the missing invariant that record.source_id and explicit source_generation match one represented completed SourceSnapshotV1. Omission does not default to any generation.

Public API compatibility repair

A compatibility regression showed that making the original implementation module private had also removed unaffected historical paths such as wardnet_reputation_core::model::EvidenceRecordV1. Exact head d3d33042fdd8a3458edd3a01394ac8b303359be6, CI 34149238551, rust job 101827797655, failed with Rust E0603 on that external import. 1f9fcda2ae7d6d0751774f58c8e3863b2d8b45cd restored the public namespace.

Fresh review then found that a blanket-public model module re-exposed the superseded generation-unbound model::EvidenceSnapshotV1, creating a second public v1 snapshot authority that could bypass exact-generation membership. Exact test-only head 51a1d6d8329c99fc6a1e892e9150164dcddb641d added a compile_fail rustdoc while retaining unaffected model::EvidenceRecordV1 compatibility. CI 34150552749, rust job 101831816239, passed ordinary locked workspace tests and failed only because the obsolete aggregate still compiled. The narrow compatibility facade now excludes only that superseded public authority.

Intervening delta adopted

The branch advanced concurrently through 9a30c26e9977bfdd749c11471a92a61571e1268b. That delta was read and retained rather than overwritten: it adds SOURCE_GENERATION_TRACEABILITY.md and API documentation for the exact-generation/provenance boundary. It does not change foreign-owner responsibilities.

Hostile RED — bounded admission identity

Fresh exact-source review found a second valid contract defect: the new wrapper EvidenceSnapshotRecordV1.source_generation is untrusted text, but it was not bounded before membership scanning. Existing represented source identities are bounded, yet an oversized wrapper value could still reach comparison and produce only an eventual membership mismatch.

Test-only head a2cfd2e108ec8e75c54dd896225809a7c1ccabb5 added a 1,025-byte hostile generation and required BoundExceeded("snapshot_record.source_generation"). Hosted CI 34152014206, rust job 101836077859, acquired GitHub-hosted Ubuntu 24.04, passed checkout/toolchain/fmt and preceding tests, then failed exactly because the implementation returned MissingSourceSnapshot instead of the bounded-input error. This is the causal RED against unchanged production.

Production repair d86d8f2a18cce69f3bebb80ec3ef01f38db74ea7 validates the admission-only generation as nonblank text with the v1 1,024-byte ceiling before matching, then reuses the existing aggregate validation authority and exact (source_id, source_generation) membership rule. Documentation head 1b183e784750d56d4cbeda469d2ced75811ae08c makes that bound and RED evidence code-current and records NIST SP 800-218 SSDF 1.1 as the final normative reference while noting SP 800-218 Rev. 1 / SSDF 1.2 remains an Initial Public Draft.

Exact-current GREEN

Exact current head remains 1b183e784750d56d4cbeda469d2ced75811ae08c, a linear/non-force child of the executed bounded-input RED and causal repair. It keeps model.rs as a private implementation module, exposes a narrow compatibility namespace for unaffected v1 types, makes the generation-bound root EvidenceSnapshotV1 the sole public v1 snapshot authority, and bounds wrapper generation identity before membership matching.

Exact-current CI 34152467045 is terminal SUCCESS. Rust job 101837405034 acquired a real GitHub-hosted runner and passed checkout, toolchain setup, cargo fmt --check, the locked workspace tests including both generation regressions, and strict Clippy. Exact-current Fuzz 34152466976, fuzz job 101837450961, is also terminal SUCCESS after all four bounded targets completed with no crash artifact upload. No predecessor check is promoted as current-head GREEN.

Current formal review inventory and inline review-thread inventory are both empty. The parent stack remains #175 -> #176 -> #178 -> #179 -> #183; this child stays Draft until prerequisite protected integration and must reacquire its own integration/security/review gates after parent movement. It is not independently mergeable to protected main through stack collapse.

No self/model approval, routine administrator bypass, gate weakening, force push/destructive rebase, mutable foreign dependency, source copy, cross-service SQL, no-op redispatch, or predecessor-result transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}