feat(evidence): verify persisted deletion inventory commitments

[seonghobae]

Partial implementation of #10, stacked on exact PR #140 head 959aab2c23e38f33fa355de8d832defc39118364.

Buyer/audit gap

PR #140 emits a deterministic credential-free commitment after exact sensitive-data deletion receipt-set verification. A durable evidence owner also needs a bounded versioned representation that can be reconstructed and reverified against the externally expected request scope and exact declared-copy inventory without duplicating OriginWeave's private canonicalization logic.

Live dependency alignment

The previous branch targeted stale #140 head de243e7ed6e60b57f7ab5b42d6c0b8f3a6a89a99. Content-aware merge head f2dc2bf48ffbcd4b6b887003eee060e5ae7a5699 now uses the exact current parent tree and overlays only this lane's seven unique production/test paths. Fresh ancestry is ahead 29 / behind 0 with merge base exactly 959aab2c23e38f33fa355de8d832defc39118364; the diff remains those seven paths. No force push or destructive rebase was used.

Implemented contract

The current branch provides:

• SensitiveDeletionPersistedCommitmentInput for reconstructing persisted credential-free scope, declared-copy count, digest, and explicit version metadata;
• fixed-width u16 persisted copy counts and architecture-independent canonical wire representation;
• explicit durable wire version 1, rejected fail-closed when unsupported;
• bounded parsing that rejects oversized input, wrong domains, missing/trailing fields, alternate length/integer spellings, invalid UTF-8, overflow, and structurally invalid enclosed commitments;
• canonical snapshot export from a validated commitment without duplicating field-copy or width-conversion logic;
• emission of the durable envelope only after exact receipt-set verification succeeds; and
• re-verification against exact request, tenant, retention policy, and duplicate-free non-empty declared inventory through the existing order-independent commitment authority.

Public boundaries retain useful rustdoc and deterministic credential-safe standard Rust errors, preserving enclosed structural errors as sources only where applicable.

Exact-current proof

On unchanged exact head f2dc2bf48ffbcd4b6b887003eee060e5ae7a5699 against exact live base 959aab2c23e38f33fa355de8d832defc39118364:

• CI run 31940835206: success;
• Rust contracts: repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc success under Rust 1.97.1;
• Production coverage: exact owned production function/line/region/branch enforcement success;
• GitHub reports the Draft mergeable;
• no submitted formal reviews are returned; and
• no inline review threads are returned.

Security/SAST/central/model workflows not returned for this stacked Draft are not represented as passing. No predecessor-head, prerequisite-head, queued, pending, skipped, cancelled, absent, stale, synthetic, status-only, or model-only evidence is promoted to current-head proof.

Truth boundary

This proves deterministic structural consistency between one versioned loaded commitment, the externally expected scope, and one exact caller-supplied declared inventory. The durable envelope authenticates nothing by itself: it does not authenticate the persistence owner, sign or persist evidence, discover undeclared copies, prove inventory exhaustiveness or deletion, enforce retention/legal hold, prevent replacement by an attacker controlling both commitment and declared inventory, or replace storage-layer integrity/access controls.

Keep Draft while #140 and its prerequisites remain active. The scheduled actor does not merge or self-approve.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f0c7615e-702e-4786-829f-ff89e67c2986

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}