[codex] Harden authored safety boundaries

[akcorca]

What changed

• make authored condition selection and formula retraction exact, scoped, and evidence-preserving
• keep reviewed conventions and merely supported typed-law candidates out of mathematical-authority surfaces
• classify refused or missing navigation as coverage loss instead of unsafe authorization
• order authored first-loss attribution across cursor, formula, relation, identity, and host-projection domains
• add focused Rust and TypeScript regressions for the v0.43 terminal safety findings

Why

The v0.43 holdout exposed one genuine false establishment, missing exact contradiction/retraction handling, and evaluator attribution that inflated conservative navigation refusals into safety failures. The fixes close those generic boundaries without adding fixture- or probe-specific switches.

Validation

• Rust core: 618/618 tests
• TypeScript/Bun tests: 361/361 after the authority-fixture correction
• recognition challenge: 48/48
• equivalence challenge: 24/24
• domain routing challenge: 30/30
• recognition frontier: 32/32, risk 0
• semantic safety: 39/39, 0 safety failures
• corpus quality: 13,936 scored cases, 1,230 metamorphic cases
• foundation: 218/218
• native/WASM parity: 288 queries; lifecycle 11/11
• package smoke and typecheck: pass

bun run check and bun run quality reach only the RSS budget gate locally. The same clean main commit fails that macOS arm64 retained-RSS baseline (about 154 MB versus 112 MB), so this is not attributable to this diff; CI remains authoritative for the merge gate.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 642dec98-e70d-43a6-ae95-b41b645d6c81

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}