feat(evidence): record completed break-glass review

[seonghobae]

Partial implementation of #10, stacked on exact PR #121 head 2f60b6374f383131987de5b5aba900ef78725aaf.

Buyer/security gap

PR #121 records the mandatory post-event-review reference, due time, and retention deadline for one actual break-glass disclosure, but it deliberately does not prove that review occurred. A durable evidence owner needs a bounded credential-free review-completion receipt that remains recordable when review is late, binds to the exact break-glass receipt, prevents the disclosing actor from self-reviewing, and distinguishes compliant review from policy violation or incident escalation without carrying free-form sensitive findings.

Dependency

This Draft targets unchanged exact #121 head 2f60b6374f383131987de5b5aba900ef78725aaf and must remain Draft while #121/#119/#90 and their prerequisites remain active. No prerequisite check, review, status, coverage, mergeability, or synthetic merge evidence transfers.

TDD state

Current exact test-only head 48f4355abb49be60fea295ec9bbf65b62f59646d defines the intended review receipt before production support exists. The contract requires:

• immutable binding to the originating request ID, decision ID, and mandatory review reference from the exact break-glass receipt;
• one bounded reviewer identity distinct from the current/approved disclosing actor;
• completion strictly after disclosure and no later than the evidence-retention deadline;
• derived OnTime versus Late status without refusing to record a late review;
• explicit ConfirmedCompliant, PolicyViolation, or IncidentEscalated outcome;
• zero findings and no remediation reference for compliant review;
• one or more findings plus one bounded remediation reference for violation/escalation; and
• stable source-free failures for malformed identifiers, reviewer conflict, invalid completion time, or inconsistent outcome evidence.

The public shape deliberately contains no protected value, opaque-handle token, free-form finding text, approval payload, credential, prompt, model output, or provider secret. Production support is intentionally absent at this head so CI can establish the realistic RED.

Truth boundary

This slice will be credential-free review metadata only. It will not authenticate the reviewer, prove organizational independence beyond exact identity inequality, inspect review content, prove remediation execution, persist/hash-chain evidence, enforce retention/deletion, close the incident, disclose protected data, implement the trusted broker, or close #10. A trusted review service must derive reviewer identity/outcome/findings from authoritative review state and a durable evidence owner must persist and protect the resulting receipt.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7bc292ef-4e74-4d11-8e8d-92eff04c6102

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}