feat(evidence): bind deterministic capture manifest identity

[seonghobae]

Partial implementation of #199, stacked on exact PR #217 head 56fcfa56525e4f2e980e0ee05b6776d621bcddc5.

This Draft owns the next bounded structured-result-manifest identity boundary after extraction schema admission, immutable WARC records, and WARC/PROV binding. CaptureManifest deterministically binds the complete extraction-schema contract, exact WARC serialization identity, exact PROV JSON-LD identity, one non-null OriginWeave software revision, canonical record ordering, bounded record count, deterministic offline re-verification, and exact persisted manifest bytes. The manifest remains payload-free and grants no capture, persistence, retention, browser, network, model, secret, signing, or release authority.

Test-first repair lineage

A persisted manifest previously had only in-memory reconstruction/equality verification. A generic JSON reader could therefore normalize whitespace or other serialization drift without an OriginWeave API that proves the bytes are the exact deterministic manifest serialization.

The first test-only head 3b16e2245fb7564449eac1cb36ad9adc36410ca7 ran CI 32678919367; its new regression was initially masked by a canonical rustfmt failure. That formatting-only test repair produced exact semantic RED head 57788f271b9d74362f55d538c953ec58539d0c66. CI 32679092382, Rust job 97292462184, passed repository contracts and canonical formatting, then failed at workspace check with E0599 because CaptureManifest::verify_serialized_json did not exist.

The canonical branch now exposes a typed exact-byte verifier. It compares candidate bytes only with CaptureManifest::to_json() and deliberately does not parse or normalize JSON: a trailing newline or any other serialization drift is CaptureManifestVerificationError::IdentityMismatch. The operation performs no network, browser, persistence, model, signing, or authority action and does not authenticate the producer. The new public behavior is recorded in the Unreleased changelog.

Exact-current evidence

The unchanged current contributor head is 1e2ce3d4071a1a75ee891bdcd71c506b3b50d4bc, with live base 56fcfa56525e4f2e980e0ee05b6776d621bcddc5.

On this exact head:

• CI run 32679259733: success;
• Rust contracts job 97292944926: exact checkout of 1e2ce3d4071a1a75ee891bdcd71c506b3b50d4bc; repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success under the repository Rust 1.97.1 contract;
• the exact serialized-manifest regression persisted_capture_manifest_requires_exact_deterministic_serialization: success;
• Production coverage job 97292944701: success, with the exact verifier reporting owned production functions, lines, regions, and branches all 100%;
• exact coverage artifact exact-coverage-1e2ce3d4071a1a75ee891bdcd71c506b3b50d4bc: artifact ID 9503659846, ZIP SHA-256 0dda43327a06537c9fd0605b5b6bc9d140d3a5dbce623094635c31059ebfa5c7.

No exact-head SAST, Security Scan, or Manifest V3 workflow run is exposed for this stacked head, so predecessor or absent evidence is not promoted to passing. Current formal-review and inline-review-thread inventories are empty.

No predecessor check or review transfers to this branch. It remains Draft and dependency-bound on #217. Protected-main AGENTS.md remains authoritative; this scheduled actor does not merge, self-approve, tag, publish, mutate workflows, add secrets, or weaken gates.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}