feat(core): add typed semantic node query contract

[seonghobae]

Partial implementation of #28.

Buyer-visible boundary

This Draft adds SemanticNodeQuery, a bounded typed selector over already-authority-validated semantic observations. Queries require at least one reviewed selector and support exact semantic role, exact accessible name, and required NodeActionKind; attacker-controlled selector text is bounded. Matching is descriptive only and grants no browser/action authority, CSS/XPath/raw-DOM selector surface, or arbitrary JavaScript capability.

Live dependency / stack state

• prerequisite PR feat(core): add bounded semantic node observation contract #52 / feat/semantic-node-observation: exact head adcafe10003cd92bb1e094b052b63c26a4f2bfcf;
• current feat(core): add typed semantic node query contract #57 / feat/semantic-node-query: exact head 0300473ed3266bad63b25520327903fa509856bd;
• protected main: 0841d2ab3d8b5e60a03c0a8e818cf438e2716829.

After #52 advanced, #57 had become diverged from its live prerequisite. The current head non-destructively reconstructs the query-only child delta on the exact live #52 tree while preserving the intervening parent security tightening for bare hexadecimal-prefix hosts. Fresh comparison from exact #52 to #57 is ahead 17 / behind 0, with merge base exactly adcafe10003cd92bb1e094b052b63c26a4f2bfcf. The child delta remains exactly four paths: CHANGELOG.md, crates/originweave-core/src/lib.rs, crates/originweave-core/src/semantic_observation.rs, and crates/originweave-core/tests/semantic_node_query.rs. No predecessor evidence transfers.

Exact-current evidence

On unchanged exact head 0300473ed3266bad63b25520327903fa509856bd:

• CI run 32665102536: success;
• Rust contracts job 97257174340: repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc/API documentation success;
• Production coverage job 97257174419: exact owned-production function/line/region/branch enforcement success, with all four dimensions at 100%;
• exact coverage artifact 9499812314, uploaded ZIP SHA-256 f5f6baed02c716c1e77386068a5d38ec40c0aa0d7f66c5fa4f7fe9afa0643ad6;
• Manifest V3 Compatibility run 32665102706: success;
• checkout evidence in the coverage job is exact head 0300473ed3266bad63b25520327903fa509856bd;
• formal reviews returned: none;
• inline review threads returned: none; and
• GitHub reports the Draft open and mergeable against exact live feat(core): add bounded semantic node observation contract #52.

Only workflows actually returned for this exact feature-base head are passing evidence. SAST/Security and other absent protected-main workflows remain absent evidence, not passing. No independent approval is claimed or inferred.

Scope boundary

No browser I/O, action execution, capability grant, policy authorization, persistence, secrets, network authority, model execution, workflow mutation, or release claim is added. Keep Draft while #52/#40 remain active.

This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: da407e31-031e-4803-9fdb-1511db981cee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}