fix(evidence): close canonical contract gaps

2026-07-12 03:15:17 +02:00
parent 4424fd3d90
commit 293d96e1a6
5 changed files with 176 additions and 15 deletions
@@ -71,3 +71,28 @@ Follow-up verification:
 - Fresh unrestricted harness attempt: 479 passed, 5 deselected; the same environmental boundary
  remains (47 Docker socket setup errors, four Docker parity failures, one isolated `uv build`
  network failure).
+
+## Final blocker follow-up
+
+The remaining four contract blockers were closed in a third TDD cycle:
+
+- `EvidenceSourceError` now always exposes the fixed public message/`args` value `evidence source
+  operation failed`; caller diagnostics are not retained. Category, details and args cannot be
+  reassigned, details remain recursively frozen and credential-screened, and an original exception
+  is available only when callers use standard exception chaining.
+- Canonical document/chunk provenance stores only URI scheme, authority and path. Userinfo is
+  rejected; query strings and fragments are removed unconditionally, including AWS `X-Amz-*`, SAS
+  `sig`, and fragment token material.
+- Binding model bases override Pydantic's unchecked `model_copy(update=...)`: merged values always
+  pass full field/model validation, so invalid copied records and top-level manifests fail.
+- A canonical document/chunk `content_hash` must equal SHA-256 of the exact stored text encoded as
+  UTF-8. This establishes the normalization boundary explicitly: line-ending/frontmatter/text
+  normalization happens before model construction; the canonical models never rewrite content.
+
+Final follow-up verification:
+
+- Focused contract suite: 45 passed.
+- Focused Ruff: passed.
+- Harness excluding Docker-backed L0 and network-dependent packaging: 476 passed, 5 deselected.
+- Fresh unrestricted harness attempt: 486 passed, 5 deselected, with the unchanged environmental
+  failures (47 Docker setup errors, four Docker parity failures, one isolated `uv build` failure).