feat(sensitive): recheck tracked reservation before disclosure

[seonghobae]

Partial implementation of #10, stacked on PR #68.

Buyer/security gap

The active sensitive-handle stack can reserve and identity-bind one in-process use, then commit or compensate that exact reservation. A trusted broker still needs an immediate pre-disclosure recheck of the same outstanding reservation after reservation but before protected-value disclosure. Reusing reserve_tracked_use would consume another use or fail at the use limit, while checking only the aggregate outstanding count cannot prove that the supplied token is the reservation owned by this state.

Dependency

This Draft is stacked on unchanged exact PR #68 head aa46d982b2bf786fe297744ac99f88b6c4c5f4cf and must remain Draft while #68/#55/#53/#46 are active.

TDD / RCA sequence

1. Exact test-only head 5a96d2931225e133768878c68d09e1a36b5ca0f6 required a narrow recheck_reservation boundary before production implemented it.
2. Production head 02678764a1860c6847d1e9d882e0fb40e89ff88a implemented the exact outstanding-reservation recheck. Rust contracts, formatting, full tests, strict Clippy and rustdoc succeeded, but CI run 31452394593, Production coverage job 93659204099, failed the repository's exact branch gate at 508/512 branches.
3. The exact coverage artifact localized all four misses to short-circuit branches inside recheck_reservation: malformed caller authority, malformed immutable state authority, malformed caller audience, and malformed immutable state audience.
4. Head d6e5f180e87f7caa39a6a16d35a2de455a39a282 added realistic malformed caller-authority and caller-audience recheck cases. Those inputs are reachable after a valid tracked reservation and must fail closed immediately before disclosure.
5. Head c6845af11f71f96afce69169140aa9a7b78c75a4 removed the two unreachable duplicate state-scope validation branches. An outstanding reservation can exist only after reserve_tracked_use validated that immutable state scope's authority and audience; malformed state scope cannot manufacture an outstanding reservation through the public API. Exact coverage became green there, while Rust contracts exposed only canonical rustfmt line wrapping.
6. Current exact head de79d85e6be5131036db119efab767f0eb76a816 applies exactly that rustfmt delta without changing behavior.

Exact-head evidence

On unchanged exact head de79d85e6be5131036db119efab767f0eb76a816 against unchanged prerequisite #68 head aa46d982b2bf786fe297744ac99f88b6c4c5f4cf:

• CI run 31453149013: success;
• Rust contracts job 93661396310: repository Python contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc all success;
• Production coverage job 93661396348: success, including exact owned production function/line/region/branch enforcement;
• CodeRabbit exact-head commit status: success;
• no inline review threads are currently returned; and
• GitHub reports the Draft mergeable against its unchanged exact prerequisite base.

No predecessor-head check, review or mergeability result is transferred to the current head. Review/security workflows that require a non-Draft PR remain separate gates and are not inferred from CI or CodeRabbit status.

Implemented boundary

The branch now:

• authorizes the same still-outstanding reservation without consuming another use;
• rejects a token owned by another state instance as ReservationNotOutstanding;
• rejects already committed or compensated reservations as no longer outstanding;
• rechecks exact caller authority, authenticated audience and exclusive expiry immediately before disclosure;
• rejects malformed caller authority/audience fail closed;
• preserves the reservation and counters when recheck is denied; and
• makes authoritative revocation take precedence over reservation/request detail mismatches, preserving the existing no-policy-leakage ordering.

Truth boundary

This remains an in-process policy primitive. It will not authenticate a workload, resolve or disclose a protected value, prove that compensation is truthful, provide durable/cross-process transactionality, perform KMS/encryption, persist state, or create the complete trusted broker. A future broker must call the recheck inside its own transaction/locking boundary immediately before disclosure.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 90c73d7c-7445-471c-9981-41fcfc0bf834

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}