feat(evidence): bind node outcome provenance to target origin

[seonghobae]

Partial implementation of #28, stacked on PR #64.

Buyer/correctness gap

PR #64 correctly refuses to treat command acknowledgement or pre-dispatch provenance as action success, but its constructor previously accepted independently verified NodeStateChanged provenance whose source URL belonged to a different origin than the governed action target. That could let an unrelated document prove the wrong page's node post-condition.

Dependency

This Draft is stacked on unchanged exact PR #64 head 2c45411ed9aa0eecca2d06c85659db9f4bb85e4d and remains Draft while #64 is active.

Test-first implementation

Exact test-only head 367554a1470f173aac978d0549aa0468a7427cd0 established the missing origin-binding contract. Exact current head 55b1421e25c5b68ca5f3b05fab37db8f4f1e22be now retains canonical source origin in ProvenanceRecord and makes VerifiedActionOutcomeEvidence::new return the stable PostConditionOriginMismatch error when NodeStateChanged provenance does not match the canonical governed target origin.

The restriction is deliberately specific to NodeStateChanged; UrlChanged, DialogStateChanged, and NetworkMutationObserved are not forced to use the action target origin because legitimate observed outcomes can involve another origin. Canonical-equivalent URLs such as https://APP.EXAMPLE:443/... remain accepted through the existing Origin normalization.

Exact-head verification

CI run 31485218503 completed successfully on exact head 55b1421e25c5b68ca5f3b05fab37db8f4f1e22be. The branch is directly ahead of unchanged live base 2c45411ed9aa0eecca2d06c85659db9f4bb85e4d with no base drift, and no formal reviews or inline review threads are currently returned for this head.

Truth boundary

This is a credential-safe evidence-construction invariant only. It does not prove browser dispatch, document/node identity, frame identity, clock provenance, a real post-condition observer, redirect authority, network attribution, or complete the Chromium vertical slice. It remains Draft because prerequisite #64 is still active.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fdf7b9cd-58a8-4776-bbac-c38c3082cb14

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}