feat(evidence): refuse untrusted payloads without identity and bounds

[seonghobae]

Documents, serialized records, model checkpoints, and LLM outputs stay untrusted until identity, provenance, size, and nesting depth validate (AGENTS.md contract 18; ADR 0008). Recovery is the computed share of accept/reject flags that match known truth versus accepting every payload.

Local gates:

• cargo test -p payload_bound --all-targets GREEN after RED (package did not exist)
• clippy -D warnings PASS
• workspace contract PASS
• docstring contract PASS
• lines 29/29; nightly-2026-08-01 branches 18/18

Does not allocate migration 0008. Does not recreate causal_language, inferred_status, relation_absence, or other in-flight crates.

Keep this PR draft. Preferred merge remains #46 only when exact-head required Checks pass and a qualifying independent (non-Cursor/CodeRabbit) APPROVE exists. OpenCode CHANGES_REQUESTED on #46 is still on stale 835922c — do not empty-commit.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 14ece4bb-10a2-4243-8e1d-e5ad82487568

📥 Commits

Reviewing files that changed from the base of the PR and between c45be17 and 1576e7f.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (20)

• ARCHITECTURE.md
• CHANGELOG.md
• Cargo.toml
• README.md
• crates/payload_bound/Cargo.toml
• crates/payload_bound/src/bound.rs
• crates/payload_bound/src/error.rs
• crates/payload_bound/src/lib.rs
• crates/payload_bound/tests/crate_contract.rs
• crates/payload_bound/tests/payload_bound_contract.rs
• docs/TRACEABILITY.md
• docs/adr/0008-immutable-evidence-identities-digests-and-spans.md
• docs/adr/0011-standalone-modular-msa-boundary.md
• docs/adr/README.md
• docs/connectors/naruon-artifact-consumer.md
• docs/research/payload-bound-identity.md
• docs/research/standards-and-literature.md
• docs/validation/temporal-event-foundation.md
• scripts/check_workspace_contract.py
• tests/quality/test_check_docstrings.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current head 1ceea58 includes origin/main; changelog, ADR index, and validation-ledger conflicts were merged by preserving both the payload-bound and current API entries. Exact-head proof passed: cargo fmt --all -- --check; cargo test -p payload_bound --offline (6 tests); workspace contract; documentation validation; Rust docstring contract; git diff --check. Protected merge remains gated by current Checks and independent approval.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Current-head validation update (e83196f): fixed the quality contract to derive the Rust crate count from scripts/check_workspace_contract.py instead of hard-coding 10. Local evidence: 89 quality tests passed; coverage 100% (991/991 statements, 442/442 branches); workspace, docstring, documentation, and diff checks passed. Please review and rerun Checks against this exact head; merge remains subject to the repository's two independent approvals and protected rules.

[seonghobae]

Current-head review refresh for e83196f:

• Untrusted evidence payloads require identity and bounded content before entering the analytical contract.
• git diff --check, documentation validation, workspace contract, docstring contract, and cargo fmt --all -- --check passed locally.
• The displayed failed checks were cancelled runs, not failed steps. The Rust Foundation CI run was explicitly requeued for this exact head and is currently queued; merge remains withheld until revalidation and qualifying approvals complete.
• No source defect was found at this exact head; no approval is being self-issued.

[seonghobae]

Rebased current head 1576e7f onto origin/main. The changelog conflict retains both payload-bound and current-main entries; inherited documentation trailing whitespace was removed. Local merge-tree, git diff --cached --check, and cargo fmt --all -- --check pass. Exact-head hosted checks and required independent approvals remain required before protected merge.