feat(relations): bind operator context

[HardMax71]

Summary

• freeze the operator-owned relation context digest in the controller registry
• verify one relation audit plan against its envelope digest, trigger, selectors, and all four snapshots
• reuse that verifier from repository projection and reject substituted context

Validation

• cargo nextest run --workspace --locked
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test --manifest-path fuzz/Cargo.toml --locked --release
• cargo clippy --manifest-path fuzz/Cargo.toml --all-targets --locked -- -D warnings
• staged amiss check --profile enforce
• prek run --hook-stage pre-push

---

Summary by cubic

Binds every relation audit plan to the operator-owned context digest registered in the controller registry, so projection rejects plans whose context was substituted.

• Adds context_digest to RelationPlan and verifies it against the envelope digest, trigger, selectors, and all four snapshots in the new shared verify_relation_plan.
• project_relation_evidence now uses the shared verifier instead of its local plan_matches_transition check.

^{Written for commit 4784b67. Summary will update on new commits.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: de243f58-8162-4699-9dfc-a988ad99484c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Tip

The relation plan is now bound to the registered operator context digest, and every claim in the PR holds under the repository's own gates.

Session details

run — cargo nextest run --workspace --locked (1710 passed), clippy on both controller crates (-D warnings), the similarity twin-edge gate (scripts/similarity-gate.sh, 0 new edges), and the staged amiss check --profile enforce scan (exit 0, 0 findings).