feat(core): bind enterprise approvals to immutable intent

[seonghobae]

Partial implementation of #202. This PR owns the bounded in-memory enterprise maker-checker approval lifecycle and one-shot policy-use boundary.

Authority boundary

EnterpriseApprovalRequest binds an exact immutable ApprovalScope, opaque already-authenticated principal references, trusted validity window, monotonic transition time, and bounded use count. The policy crate enforces exact (issuer, subject) requester/checker tuple separation, state/time invariants, expiry, use accounting, one-shot evaluation, and process-local outstanding-use terminal invalidation. It does not authenticate principals, prove that two aliases/federated identities represent distinct real actors, establish checker role, resolve tenant membership, or grant business authorization. Those checks remain the responsibility of the trusted identity/workflow boundary before approve/deny.

Successful consume returns a non-cloneable EnterpriseApprovalUse rather than reusable approval evidence. The use retains the exact approved scope, consumption time, exclusive expiry deadline, and shared process-local terminal invalidation state. evaluate_at consumes the use and revalidates the live request's exact action/origin/intent scope before lifecycle/time state, then applies trusted-time rollback/expiry and terminal expiry/revocation checks before introducing approval evidence into a private cloned policy context. R5 legal consent remains non-delegable.

Test-first repair lineage

Earlier RED→GREEN work on this branch established monotonic trusted-time transitions, non-cloneable one-shot use, evaluation-time expiry/rollback enforcement, revocation of issued uses including the final exhausted-but-unexecuted use, actor-before-lifecycle privacy ordering, process-local revocation/expiry invalidation, and explicit crash/durability limits.

A later exact test-only RED head 248740a7cfdec0d534dda803ab5f04c2110cb1ca, CI run 32894871213, Rust-contracts job 97955076100, reproduced a separate scope-integrity/privacy defect: a consumed Purchase approval use presented to an unrelated low-risk request could reach Ok(Allow), and at the approval deadline a mismatched request returned Expired, exposing lifecycle state before scope mismatch.

Production repair f04980c7a21b8370b69ded84cd2757fd802a312c reconstructs ApprovalScope directly from the live request and rejects inequality before trusted-time rollback, direct expiry, terminal invalidation, or policy evaluation. A mismatch burns the non-cloneable use because evaluate_at consumes self; it does not restore or widen approval authority. Current head e0740a6f3a41067a4460249378e0266815018a74 then aligns ADR 0017 with that implemented scope-before-lifecycle/privacy ordering; it does not replace the production repair.

Exact-current state and evidence

Protected main is exact b05d5acca82b9d916ada2c8e82f59f92a89817e1. Current contributor head is exact e0740a6f3a41067a4460249378e0266815018a74.

On this unchanged exact head:

• CI run 32895878511: success;
• Rust contracts job 97958338464: exact-head checkout; repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success under the repository Rust 1.97.1 contract;
• Production coverage job 97958338137: success; exact-head checkout and the coverage enforcer report production functions, lines, regions, and branches are 100% covered;
• exact coverage artifact 9581245170, ZIP SHA-256 fe8fac20398da0dc14b74f9c5ce35999706dc3aa9afa867b39aa8b240aa4e135;
• SAST Semgrep run 32895880062: success;
• Security Scan run 32895879824: success;
• no exact-head Manifest V3 result is claimed for this non-browser slice;
• all fetched inline review threads are resolved; and
• formal review inventory contains automated/model COMMENTED submissions only, with no qualifying independent current-head APPROVED review.

A current Devin informational thread notes that a caller that violates the trusted-clock boundary by presenting a backdated timestamp can remain inside a use-local validity window until the live request itself has observed expiry. ADR 0017 scopes lifecycle time to a trusted control-plane clock and process-local terminal invalidation; durable/cross-process trusted-time and transactional cancellation remain #202 work. This is not converted into a local permissive fallback.

Queued, pending, skipped-required, absent, stale, predecessor, synthetic, status-only, bot-comment, author-comment, and model-only evidence is not promoted as passing or approval.

Scope and durability boundary

The terminal signal coordinates only the live EnterpriseApprovalRequest and its issued uses in the same process. Once an evaluation has passed its validity check it is considered in flight. This crate does not persist or reconstruct consumption, expiry, or revocation state after process failure and does not provide distributed cancellation/consensus. Crash-safe/distributed consumption and revocation, canonical actor correlation, tenant identity, signed/auditable evidence, operator workflow, and durable enterprise control-plane semantics remain owned by #202 and must preserve exact-scope, real-actor separation-of-duties, monotonic-time, expiry, terminal-state, one-shot, and privacy-ordering invariants.

Protected-main AGENTS.md remains authoritative. This scheduled writer does not merge, self-approve, force-push, destructively rebase, alter workflows/rulesets/secrets, tag, release, or publish.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 178a688f-97d6-4ea2-84c3-62de0744b729

📥 Commits

Reviewing files that changed from the base of the PR and between bc6c99f and ae36811.

📒 Files selected for processing (5)

• crates/originweave-policy/src/enterprise_approval.rs
• crates/originweave-policy/tests/enterprise_approval_lifecycle.rs
• crates/originweave-policy/tests/enterprise_approval_scope_privacy.rs
• crates/originweave-policy/tests/enterprise_approval_single_use.rs
• docs/adr/0017-enterprise-maker-checker-approval.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

opaque principal 검증, 불변 승인 범위, maker-checker 승인 수명주기를 추가했다. 승인 전환에 단조 시간과 만료 처리를 적용했다. 소비 결과를 비복제 일회성 정책 평가 사용으로 변경하고 공개 API, 테스트 및 ADR을 추가했다.

Changes

엔터프라이즈 승인

Layer / File(s)	Summary
승인 계약과 공개 API crates/originweave-policy/src/enterprise_approval.rs, crates/originweave-policy/src/lib.rs, crates/originweave-policy/tests/enterprise_approval_lifecycle.rs, crates/originweave-policy/tests/enterprise_approval_clone_contract.rs	승인 주체, 상태, 요청 및 오류를 정의하고 공개 재export했다. 요청 제약과 비복제 계약을 검증한다.
승인 전환과 소비 crates/originweave-policy/src/enterprise_approval.rs, crates/originweave-policy/tests/enterprise_approval_lifecycle.rs, crates/originweave-policy/tests/enterprise_approval_transition_guards.rs, crates/originweave-policy/tests/enterprise_approval_scope_privacy.rs	승인, 거부, 철회, 취소 및 소비에 역할, scope, 만료, 상태와 사용 한도 검증을 적용한다. 잘못된 주체와 범위의 요청을 상태 변경 없이 거부한다.
단조 시간과 만료 가드 crates/originweave-policy/src/enterprise_approval.rs, crates/originweave-policy/tests/enterprise_approval_time_integrity.rs, crates/originweave-policy/tests/enterprise_approval_transition_guards.rs	이전 전환보다 이른 신뢰 시간을 NonMonotonicTime으로 거부한다. 만료 시 요청을 Expired로 전환하고 후속 전환을 차단한다.
비복제 승인 사용과 정책 평가 crates/originweave-policy/src/enterprise_approval.rs, crates/originweave-policy/src/lib.rs, crates/originweave-policy/tests/enterprise_approval_single_use.rs, CHANGELOG.md	consume이 비복제 EnterpriseApprovalUse를 반환한다. evaluate_at은 시간과 철회 신호를 확인한 뒤 private policy context에서 승인 범위를 평가한다. 평가 결과와 관계없이 사용을 소모한다.
설계 기록과 저장소 문서 docs/README.md, docs/adr/0017-enterprise-maker-checker-approval.md, docs/adr/README.md	Proposed ADR 0017과 문서 색인에 maker-checker, 단조 시간, terminal state, 철회 및 일회성 사용 계약을 기록했다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🔵 Low · up to ae368

The approval lifecycle and privacy-ordering changes are supported by passing repository checks and complete production coverage. Merge is reasonable with owner follow-up for the ADR authority-boundary wording and for tightening clock-rollback coverage to assert the required error type.

Sequence Diagram(s)

sequenceDiagram
  participant Requester
  participant EnterpriseApprovalRequest
  participant EnterpriseApprovalUse
  participant PolicyEvaluator
  Requester->>EnterpriseApprovalRequest: 정확한 ApprovalScope로 consume
  EnterpriseApprovalRequest-->>Requester: 비복제 EnterpriseApprovalUse 반환
  Requester->>EnterpriseApprovalRequest: checker가 revoke 수행
  EnterpriseApprovalRequest->>EnterpriseApprovalUse: 공유 revocation signal 설정
  Requester->>EnterpriseApprovalUse: evaluate_at 호출
  EnterpriseApprovalUse->>EnterpriseApprovalUse: 시간과 철회 신호 검증
  EnterpriseApprovalUse->>PolicyEvaluator: private PolicyContext로 승인 평가
  PolicyEvaluator-->>Requester: Decision 반환

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 72.73% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 55 functions across 5 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 엔터프라이즈 승인을 변경 불가능한 의도에 결속하는 핵심 변경을 정확히 요약합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 72.73% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 55 functions across 5 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/enterprise-approval-intent-lifecycle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head e0740a6f3a41067a4460249378e0266815018a74.

• Head SHA: e0740a6f3a41067a4460249378e0266815018a74

• Workflow run: 32934969677

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (10 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (10 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (4 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (4 files)"]
  R2 --> V2["docs review"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: e0740a6f3a41067a4460249378e0266815018a74
• Workflow run: 32934969677
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head e0740a6f3a41067a4460249378e0266815018a74.

• Head SHA: e0740a6f3a41067a4460249378e0266815018a74

• Workflow run: 32934969677

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (10 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (10 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs (4 files)"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs (4 files)"]
  R2 --> V2["docs review"]

Loading