test(reputation): reject lifecycle-invalid enforcement evidence

[seonghobae]

Refs #184. Draft child of #183.

Verified finding

Exact parent #183@1b183e784750d56d4cbeda469d2ced75811ae08c binds each evidence record to its exact completed source generation, but EvidenceRecordV1::validate_at still permitted producer lifecycle state to contradict enforcement eligibility. A record could be revoked=true or deleted=true while retaining enforcement_eligible=true, and the generation-bound aggregate accepted it when all other lineage, bounds, provenance, and time checks were valid.

This is Wardnet evidence/admission policy only. It adds no source fetching, persistence, HTTP, DNS/peer/redirect/proxy/TLS behavior, EgressWeave transport authorization, Context Graph mutation, or foreign-owner code.

Executed hostile RED

Test-only f5d8f28d32cabca23a90acf86e578faeac703791 changed only crates/wardnet-reputation-core/tests/evidence_lifecycle_enforcement.rs; production was byte-identical to exact parent #183. The hostile generation-bound cases require revoked, deleted, and revoked+deleted records to fail closed when they still claim enforcement eligibility. Controls require active enforcement evidence to remain valid and revoked/deleted evidence to remain representable as non-enforcement history.

Hosted CI 34154105805, Rust job 101842225780, acquired GitHub-hosted runner 1001750277, completed exact checkout, toolchain setup, and formatting, then failed at Test; Clippy was skipped. This is the causal semantic RED, not a runner/control-plane failure.

Minimal causal repair

The implementation adds only the missing invariant after the existing schema/bounds/provenance/time/confidence validation order: if enforcement_eligible is true and either producer lifecycle flag is true, validation returns typed LifecycleIneligibleEnforcementEvidence. It does not mutate evidence. Revoked/deleted producer history remains valid when enforcement_eligible=false.

Exact-error coverage binds all three hostile lifecycle combinations to that typed error, while active eligible evidence and lifecycle-marked non-enforcement history remain positive controls. EVIDENCE_LIFECYCLE_TRACEABILITY.md records the problem, bounded-context ownership, alternatives, RED receipt, and the explicit boundary that this slice does not yet claim cross-generation monotonic producer-version/tombstone admission.

Exact-current GREEN

Current head is b2169d465aa15da9da78f5c42b785e44a4bc664d. Fresh ancestry comparison against exact parent reports ahead_by=5, behind_by=0, merge base equal to 1b183e784750d56d4cbeda469d2ced75811ae08c; no intervening parent delta was overwritten. The diff is limited to the lifecycle invariant/error, its hostile/positive regression coverage, lifecycle traceability, and the crate-doc link.

Exact-current CI 34154846345, Rust job 101844429388, is terminal SUCCESS after exact checkout, toolchain setup, cargo fmt --check, locked workspace tests, and strict Clippy. Exact-current Fuzz 34154846324, fuzz job 101844430502, is terminal SUCCESS after all four 60-second bounded targets completed with no crash-artifact upload. Formal review count is 0 and inline review-thread count is 0. No predecessor check is promoted as current-head GREEN.

Keep Draft behind #175 -> #176 -> #178 -> #179 -> #183. After prerequisite protected integration, reacquire the then-live integration/security/review/governance gates; no stacked-head evidence transfers to a retargeted protected-main candidate. Cross-generation monotonic version/tombstone admission remains the next Task 2 lifecycle slice rather than being folded into this stateless validator.

No self/model approval, routine administrator bypass, gate weakening, force push/destructive rebase, mutable foreign dependency, source copy, cross-service SQL, no-op redispatch, or predecessor-result transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Hosted RED is now exact and executed. Test-only head f5d8f28d32cabca23a90acf86e578faeac703791 kept production byte-identical to parent #183@1b183e784750d56d4cbeda469d2ced75811ae08c. CI run 34154105805, job 101842225780, acquired GitHub-hosted runner 1001750277; exact checkout, Rust toolchain, and formatting completed successfully, then the Test step failed and Clippy was skipped. That is the intended semantic RED for lifecycle-invalid enforcement evidence, not runner/control-plane failure.

Minimal GREEN was then applied without widening scope: EvidenceRecordV1::validate_at now rejects enforcement_eligible=true when producer lifecycle says revoked or deleted, using typed LifecycleIneligibleEnforcementEvidence; non-enforcement lifecycle history remains representable. Current exact head is 1e30e5c544f9fe6a7f0a0d6055da9c3927444914, which also binds the hostile test to that exact typed error. No predecessor GREEN is transferred; current-head CI/Fuzz must complete independently.