feat(sensitive): require fresh model fallback availability

[seonghobae]

Partial implementation of #10, stacked on PR #86.

Buyer/security gap

PR #86 makes sensitive-model fallback fail closed on unknown or unreviewed routes, but its availability classification had no explicit lifetime. A stale Available or Unavailable observation must not remain usable indefinitely for sensitive-model routing.

Dependency

This Draft is stacked on unchanged exact PR #86 head a2c391a5e038dc9e3d6978885d9bdd943487294f and must remain Draft while #86 and its prerequisite sensitive-data stack remain active.

TDD / RCA sequence

1. Original test-only head 34d49aea1c77491c63a22f2670d10f39a162d24d added the intended freshness contract but CI run 31496279876 stopped first at canonical rustfmt. That setup failure was not counted as the intended RED.
2. Formatting-only head 4ac8a00a2674e6b66fcea9a794c3475d874dec41 established the valid production-boundary RED in CI run 31499917777, Rust contracts job 93806922219: repository contracts and formatting passed, then the locked workspace check failed because ModelRouteAvailabilityEvidence, trusted evaluation time, and the invalid/expired decisions did not exist.
3. Production head f25de0ed1d44d25319265129c7f8353791936c42 added the bounded availability-evidence lifetime and fail-closed evaluator changes; head 746786bc8e19bc1c48b9a59534f1540b46327aee exported the new public evidence type.
4. CI run 31500329485 on exact head 746786bc8e19bc1c48b9a59534f1540b46327aee became fully GREEN: Rust contracts job 93808479509 and Production coverage job 93808479514 both succeeded, including repository contracts, formatting, locked workspace/all-target check, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage.
5. Changelog head 1437462dd5704b8cbb365702629ece2139ca24c0 recorded the new boundary. A fresh whole-PR patch audit caught one unrelated wording drift in an existing TLS changelog bullet; that was treated as a scope-integrity defect rather than accepted as noise.
6. Current exact head b1273d7bc34fffee262be4bd2da24c24520d11db removes that unrelated drift while retaining only the intended availability-freshness changelog delta.
7. Fresh exact-head CI run 31500975874 is GREEN: Rust contracts job 93810643624 and Production coverage job 93810643723 both succeeded with the complete contract and exact coverage gates.

No predecessor-head check, review, mergeability result, or synthetic status is transferred to the current head.

Implemented contract

The branch now requires:

• exact primary-route policy authorization before availability freshness or fallback is considered;
• availability to be carried in a distinct ModelRouteAvailabilityEvidence value with an exclusive valid_until horizon;
• caller-supplied trusted_time from the same authoritative time domain as that horizon;
• a zero availability horizon to fail closed as PrimaryAvailabilityInvalid;
• trusted_time >= valid_until to fail closed as PrimaryAvailabilityExpired;
• fresh unknown availability to remain fail closed as PrimaryAvailabilityUnknown;
• only fresh explicit Unavailable evidence to enter fallback consideration; and
• the existing requirement that fallback exist in both request and trusted scope and independently satisfy the exact reviewed model-route policy.

Focused regressions cover fresh primary availability, primary-policy precedence over freshness, invalid and exact-boundary expiry, unknown availability, absent/one-sided fallback policy, exact reviewed fallback success, and mismatched fallback denial.

Exact-current evidence

For exact head b1273d7bc34fffee262be4bd2da24c24520d11db against unchanged exact base a2c391a5e038dc9e3d6978885d9bdd943487294f:

• CI run 31500975874: success;
• Rust contracts job 93810643624: success;
• Production coverage job 93810643723: success, including exact owned production function/line/region/branch enforcement;
• GitHub reports this Draft mergeable against its unchanged prerequisite base; and
• no formal reviews or inline review threads are currently returned for this exact head.

Truth boundary

This deterministic policy slice does not probe provider health, prove when an availability observation was collected, attest the clock, authenticate or invoke a provider, retry, disclose protected values, persist health state, or execute the selected route. Constructing availability evidence does not make the observation authoritative. A trusted broker/orchestrator must derive the availability state and validity horizon from its reviewed runtime boundary, supply evaluation time from the same authoritative time domain, and execute only the exact route authorized by this policy.

This PR does not close #10. Keep it Draft while #86 and the prerequisite sensitive-data stack remain active; fresh exact-head/live-base acceptance is required after any dependency movement.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f30cc8eb-7f09-41b9-bd14-83aa910e11b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}