feat(sensitive): compose full-field model disclosure authority

[seonghobae]

Partial implementation of #10, stacked on PR #88.

Buyer/security gap

The active sensitive-model stack separately governs sensitive-data disclosure, exact provider/model/region policy, invocation metadata, output policy, and fallback. Those independent decisions must not be combinable across different tenant/task/field/purpose/destination/classification authorities, and an invocation route match alone must never authorize raw protected field bytes to enter a model request.

Dependency

This Draft remains stacked on exact PR #88 head 121d9d70d6c5592b9dff06d7ba09ee563958bfef and is not independently integrable while that prerequisite and the earlier sensitive-data/model-policy stack remain active.

TDD / RCA sequence

1. The exact test-only head 1dcac8437e1011fdaed89aeea33bb793f7c3d869 required a narrow full-field model-disclosure composition boundary before production exported one.
2. CI run 31506672570, Rust contracts job 93829914772, checked out that exact head. Python repository contracts and formatting passed, then cargo check --locked --workspace --all-targets failed with E0432 because ModelDisclosureDecision and evaluate_full_field_model_disclosure did not exist. This is the intended exact-current RED boundary rather than predecessor or synthetic evidence.
3. Exact implementation head f2fbcae3f07cad722f43580aa5be0b4e691d2a9c adds only the deterministic metadata composition primitive and its public export. It first requires the existing sensitive-data policy to return explicit FullFieldDisclosure, then requires the disclosure request to carry the same complete SensitiveDataAuthority as the model invocation request, and only then evaluates the existing route/context/prompt/schema/token/expiry invocation policy. Every weaker disclosure outcome remains non-authorizing, cross-authority composition fails closed, and typed invocation denial is preserved.

Exact-head proof

On exact head f2fbcae3f07cad722f43580aa5be0b4e691d2a9c against exact prerequisite #88 head 121d9d70d6c5592b9dff06d7ba09ee563958bfef:

• CI run 31510796392: success;
• Rust contracts job 93843931110: repository Python contracts, formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc all success;
• Production coverage job 93843931222: exact owned production function/line/region/branch enforcement success;
• no formal reviews or inline review threads are currently returned; and
• GitHub reports this Draft mergeable against its exact prerequisite base.

No predecessor-head check, review, or status is transferred to the current head.

Implemented contract

The current branch requires that:

• only explicit DisclosureDecision::FullFieldDisclosure can reach the raw-model-input composition boundary;
• DenyAccess, opaque-handle, derived-value, partial-field, human-approval-required, and dual-control-required outcomes remain non-authorizing;
• disclosure and invocation must carry one identical complete sensitive-data authority tuple before their separately valid policy decisions can be composed; and
• route or invocation denial remains typed as ModelDisclosureDecision::InvocationDenied(...) rather than being collapsed into authorization.

Truth boundary

This slice does not prove that deterministic or handle-based execution was impossible, authenticate a workload/provider, resolve or disclose an opaque handle, carry a protected value, invoke a model, validate output bytes, enforce retention, attest runtime region/clock, or execute fallback. ModelDisclosureDecision::Authorized is metadata-only authority composition. The trusted broker still owns necessity, runtime/provider authentication, protected-value resolution inside its transaction boundary, exact route execution, output validation, and retention/export enforcement.

Keep Draft while #88 and its prerequisite sensitive-data/model-policy stack remain active. This PR does not close #10.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6f4197e-07dd-41be-9e82-c896a0bd1041

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}