fix(reliability): preflight transition digest capability before envelope parsing

[seonghobae]

Current authoritative state

This transition digest-capability preflight defect is repaired on the existing canonical single-writer Draft PR #222 / branch fix/digest-provider-preflight-221, which explicitly Closes #234. Protected shipped truth and the frozen v0.6.0 source candidate remain exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact Draft head is c4cbb7b164bf9be4c758e7c8e6a0b02384b695b1 against that protected base.

Current src/documentTransitionEvidence.ts resolves one usable digest capability before either caller-controlled object/JSON source or strict-byte source is reflected or parsed. It then parses both inputs through the existing strict envelope boundary and hashes the previous and resulting canonical envelopes sequentially with the same resolved provider capability. An accessor-backed mutable digest property is therefore read once per transition; the original provider receiver is preserved for both calls. Malformed/non-callable provider authority fails through the existing payload-redacted revision boundary before source processing.

Strict envelope/schema/resource and strict UTF-8 validation remain authoritative after provider preflight. Both envelopes are validated before hashing begins, so malformed resulting input produces no partial transition evidence. Successful output remains frozen revision-only evidence with exact 32-byte SHA-256 validation and no document-content leakage. Standalone Inkspan remains network/database/credential/model independent; transport, durable persistence, authorization, tenancy, credentials, durable audit and model/provider policy remain host-owned.

Test-first lineage

The canonical #222 history retains the transition-provider RED before the narrow repair. Current src/documentTransitionEvidence.test.ts machine-checks that an unusable provider is rejected before either object or byte source processing, that one accessor-backed provider capability is resolved for both transition revisions while preserving its receiver, that hashing is sequential previous→resulting, and that both sources are parsed before any digest is emitted. Historical workflow generations establish lineage only and do not transfer after later head movement.

Exact-current-head evidence

Fresh refetch for unchanged exact head c4cbb7b164bf9be4c758e7c8e6a0b02384b695b1 confirms:

• CI 32075852586: completed / success;
• Security Scan 32075852590: completed / success;
• SAST Semgrep 32075852629: completed / success;
• formal submitted reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the PR Draft and mechanically mergeable.

Repository exact-head technical success is not qualifying independent approval and does not replace separately applicable central workflows or then-live governance. Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, status-only or model-only evidence remains non-passing.

Downstream / integration boundary

Draft #277 is stacked on current #222 authority and must independently prove its own exact head; parent evidence does not transfer. The #234 defect is active-PR repaired behavior only and is not protected-main shipped truth. Keep this issue open until #222 integrates under live governance. Keep #222 Draft/unmerged while #118 owns the frozen v0.6.0 publication/provenance/digest boundary. Any #222 head/base/ruleset movement invalidates corresponding evidence and requires fresh revalidation. Do not create a competing digest-provider writer, transfer predecessor evidence, self-approve, weaken gates, move protected main or fabricate release identity.