feat(reputation): make complete source replacement atomic and CAS-bound

[seonghobae]

Refs #188. Draft child of #187.

Bounded security-evidence change

Exact parent #187@b549c4e3f894492ae8d235c79f3447440981e3e8 already provides exact source-generation membership plus cross-generation producer lifecycle/tombstone admission. This child adds the missing pure operation that turns one authenticated complete source batch into a new immutable EvidenceSnapshotV1.

Wardnet owns this source/evidence-admission invariant. The change performs no source fetching, HTTP/304 interpretation, durable persistence, URL/DNS/peer/redirect/proxy/TLS authorization, Context Graph/EA mutation, quarantine execution, LLM/provider routing, or AppGuardrail analysis. It does not infer chronological order from opaque generation strings.

Executed RED → repair lineage

The initial test-only exact 64f60c0dfa0ecc4a21d29ce404618bce971ffe4c changed only the source-replacement test. Hosted CI 34159300515, Rust job 101857575281, acquired Ubuntu compute, passed checkout/toolchain/formatting, then failed in Test because the source-replacement contract did not exist. Implementation cd05b97... exposed deterministic formatting, b7aabc0... repaired that, and CI 34159970161 / job 101859505861 then exposed Rust ownership error E0505. Minimal ownership-order repair c96f512d4e89529d64a8964cad07b80ee705091f produced terminal CI GREEN 34160079365 / job 101859819975.

Fresh exact-source review found immutable source-generation identity reuse. Test-only exact b53ddde9bcd8524658cacac0efe108577bc9dd87 added a same-generation rewrite case while production remained unchanged. Hosted CI 34160409623, Rust job 101860879692, passed checkout/toolchain/formatting and failed in Test with E0599 because SourceReplacementErrorV1::ReusedSourceGeneration did not exist. Minimal repair 555c239827822bdae3d8204ef69d2f681e3d6f31 adds the typed equality rejection after exact prior-generation CAS; the generic core still does not sort opaque generation values.

A later exact-source review found a third replay-integrity defect: exact CAS plus a distinct opaque generation token still allowed SourceSnapshotV1.completed_at_unix to move backwards, so older authenticated source state could be republished under a fresh generation identity. Test-only exact 2904f11a47a149e97c1bb8f77fd7cb61376451f1 changed only tests/evidence_source_replacement.rs. Hosted CI 34161720520, Rust job 101864749405, acquired Ubuntu 24.04, passed exact checkout/toolchain/cargo fmt --check, then failed in Test while the production error/invariant was absent. Minimal production repair 7a6f56c5b576aa9948d7cd7c9e27310ef0c15212 adds typed SourceCompletionRegression and rejects only replacement.completed_at_unix < prior.completed_at_unix. Equal completion timestamps remain valid; valid_until_unix is not forced monotonic because a source may legitimately shorten its validity horizon.

SOURCE_REPLACEMENT_TRACEABILITY.md on the current head records the problem, constraints, rejected alternatives, chosen invariants, exact RED/GREEN lineage and remaining durable-storage boundary. PRODUCER_VERSION_LIFECYCLE_TRACEABILITY.md is synchronized so the parent lifecycle cursor no longer claims atomic replacement is wholly absent.

Contract now enforced

• incomplete/truncated batches fail before replacing last-known-good state;
• complete authenticated empty generations are valid and remove only the represented source's prior records;
• non-empty replacements publish only records from the exact new source generation;
• replacement records must match the exact batch source_id and source_generation;
• replacement/create is CAS-bound to the exact prior generation or source absence;
• an existing immutable source generation cannot be rewritten under the same identity;
• an existing source cannot move its authenticated completion point backwards under a distinct generation token;
• changed snapshots cannot reuse the prior Wardnet evidence_generation;
• unrelated sources/records are preserved;
• duplicate, temporal, schema, bounds, provenance and lifecycle failures continue through the existing aggregate validator;
• the operation is pure and returns a new snapshot only after the complete candidate validates.

The pure transition still does not prove durable transactionality. A later Wardnet storage/adapter slice must atomically bind authenticated provider pagination/completeness, durable producer lifecycle cursors, the accepted immutable evidence snapshot, crash recovery, retry/idempotency and last-known-good publication. Refresh failure or provider not-modified outcomes must not manufacture evidence freshness.

Exact-current evidence

Exact current head is 7f715a843236bcb79452fc1b3c84d50f34da9981 on unchanged exact parent #187@b549c4e3f894492ae8d235c79f3447440981e3e8.

• CI 34162018684, Rust job 101865605262: terminal SUCCESS after exact checkout, toolchain, formatting, locked workspace tests and strict Clippy.
• Fuzz 34162018692, fuzz job 101865650619: terminal SUCCESS on the same exact head; bounded targets ran on GitHub-hosted ubuntu-24.04 and no crash artifact was produced.
• current submitted-review inventory: empty;
• current inline review-thread inventory: empty.

Keep Draft behind #175 -> #176 -> #178 -> #179 -> #183 -> #185 -> #187. Root #175 still has the central delegated-CodeQL terminal-status publication defect owned by .github#1929, and live solo-maintainer governance remains owned by .github#772. This child is not a merge-policy probe and no guarded bypass condition is met. After prerequisite protected integration, non-force reconstruct on fresh exact ancestry and reacquire every then-live gate.

No predecessor-result transfer, self/model approval, routine administrator bypass, force push/destructive rebase, gate weakening, no-op redispatch, mutable foreign dependency, source copy, cross-service SQL, or foreign-owner implementation is introduced.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}