feat(analysis): bind non-lexical modality refusals to an analysis-run profile

[seonghobae]

Consolidation status

fold_child for the surviving Analysis Run landing vehicle #416. modality_source_v1 / tepp.modality_source.v1 is a Validation / Analysis Run profile, not a separate bounded context or independent protected-main landing authority.

Current exact child head is 067d308fb3096d2d02876230c55c71caddc32d59; protected base is main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0. Current #416 head is 03f8de2ed0a0fb842d2022d411814e440df7cfb4. Fresh comparison is diverged: this child has 10 commits not in #416 and is 81 #416 commits behind, with protected main as merge base. Keep this PR Draft and preserve every unique source/test/ADR/doctoring delta until an ordinary non-force conflict-resolving fold verifies inheritance. Simple Close is not consolidation.

Scientific finding and repair

The original profile called itself cutoff-safe while ModalitySourceDocument carried neither immutable snapshot provenance nor AvailableTime. Raw input was unbounded before identity-set allocation, request and executor cutoffs were compared as RFC 3339 text rather than temporal instants, and terminal AnalysisResultSummary.validation_status reused the domain inference label.

Repair lineage:

• RED 0a08fcab054903e907ccbef5ff8694218159b52a proves equivalent legal RFC 3339 spellings of one cutoff instant must bind identically and provider validation state must remain separate from the domain inference claim. Repair 5a9dac8cdc05665ee5b1e78c9c69c9b18b429d33 compares parsed KnowledgeCutoff::instant() values and emits terminal validation status validated.
• RED edb5d3351265d100caf260e6d8ddf207c39e3003 requires explicit immutable snapshot/availability provenance, historical replay invariance to future-unavailable duplicate identities, cross-snapshot refusal, and raw MAX_EVIDENCE_UNITS admission before duplicate allocation.
• Repair e5c1555a6d2c7f10defa0471f45d358b96954c34 adds snapshot_id and AvailableTime to every ModalitySourceDocument, rejects cross-snapshot rows before aggregation, excludes same-snapshot rows with AvailableTime > knowledge_cutoff before duplicate/domain admission, preserves visible duplicate refusal, bounds raw population before BTreeSet allocation, and derives document_count from cutoff-admitted identities.
• 2a5ef7f0f599c00f6d43513cb7137c5c867d4c01 promotes canonical corpus_split::cutoff_eligible to a production dependency; ab733e9ffd2111a6c1c63aa5fc981678a5682638 removes redundant dev dependency declarations.
• 871bd48304ac368c5429f5d62b0a35c23b014faa changes ADR 0061 from premature Accepted branch authority to Proposed and records the temporal/provenance contract. 067d308fb3096d2d02876230c55c71caddc32d59 currentizes doctoring with exact repair lineage.

Historical replay invariant: same-snapshot evidence unavailable at the requested cutoff cannot enter duplicate/domain admission, counts, artifact identity, or terminal result. Evidence visible at the cutoff still participates normally, including fail-closed duplicate detection. Cross-snapshot evidence is not historical censoring; it is a provenance violation and is rejected.

The artifact inference status remains non_lexical_modality_is_not_unique_content_not_stopword_deletion. Terminal provider validation status is separately validated. identity_recovery_rate stays library-side. This profile does not claim GPU, MCMC, topic birth/split/merge, or scientific acceptance.

Review state

All four pre-existing inline threads were re-verified against current source, replied to with exact repair lineage, and resolved: future-evidence leakage, unbounded census memory growth, duplicate dependency declaration, and the obsolete textual-cutoff-equality assumption. Current unresolved inline thread count is 0. Resolution is not approval and does not transfer across a later head move.

Remaining documentation repair

docs/adr/0061-modality-source-analysis-run.md is now Proposed, but this child still carries an added docs/adr/README.md row that says ADR 0061 is Accepted. That is a real docs-to-code mismatch. The ADR index is a large shared conflict surface also touched by many Analysis Run children; do not replace the whole file merely to change this row. The eventual #416 fold / canonical docs lane must preserve the ADR body as Proposed and currentize the index surgically.

Exact-head evidence

No predecessor receipt transfers to 067d308f.... Fresh workflows are admitted on this exact head:

• Rust Foundation CI 34785558293: queued;
• Documentation Quality 34785558308: queued;
• Security Scan 34785558269: queued;
• SAST Semgrep 34785558280: queued;
• CodeQL PR 34785558295: pending.

This PR therefore does not claim GREEN, 100% coverage, independent approval, Ready, or merge authorization. Hosted queue wait is lane-local; do not create no-op commits or manual rerun loops merely to disturb admission.

Fold / merge gate

#421 changes the same shared Analysis Run integration surface as #416 (Cargo.lock, analysis_engine Cargo/lib, documentation, TRACEABILITY, ADR index), so its unique profile source/tests/ADR/doctoring must be inherited through an ordinary non-force conflict-resolving fold after the #416 foundation stabilizes. Child-head checks/reviews do not transfer to the surviving head.

Before any successor-based Close, verify on the surviving vehicle that the explicit snapshot/availability provenance, parsed-instant cutoff binding, historical replay RED, cross-snapshot refusal, raw population bound, provider/domain status separation, tests, ADR 0061 Proposed state, and doctoring evidence all survived. Then reacquire exact-head line/branch coverage, required security/CodeQL/documentation gates, and qualifying independent review on that unchanged surviving head.

No self-approval, force push, destructive rebase, skip/xfail, coverage-denominator change, scanner suppression, no-op rerun, mutable dependency, or predecessor evidence transfer is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 4 potential issues.

[seonghobae]

Restack on protected main (a243f18)

Non-force merge of origin/main (merge commit 3a939b62); the only conflict was the CHANGELOG.md append, both entries kept. ADR 0061 already carries an admitted maturity value (active-PR).

Local evidence on the pushed head (toolchain 1.98.0): cargo test -p analysis_engine 37 passed / 0 failed, cargo clippy -p analysis_engine --all-targets -D warnings clean, cargo fmt --all --check clean, documentation/workspace/docstring contracts PASS, git diff --check clean.

🤖 Generated with Claude Code