[E13–S9 12/15] Prove source-fenced document retrieval

[salmonumbrella]

What changed

• Adds a synthetic external-consumer contract proof that retains only the stable Docbank (vault_uid, node_id, content_version_id) identity plus its bounded source fence.
• Proves the fence is applied before lexical retrieval, query expansion, vector scoring, and reranking, with both allowed and revoked versions present in the synthetic corpus.
• Derives the ANN row set transactionally from current, live, scope-selected attachments and scores only those rows. Revoked vectors never enter the ANN query, and missing or widened row authority fails closed.
• Proves a final presentation-time visibility check suppresses a version revoked after retrieval, covering the remaining TOCTOU window without giving the consumer parallel derivative authority.

Why

A final visibility check is necessary but not sufficient. If a revoked source enters FTS, ANN, expansion, or reranking first, its content has already crossed a boundary it should never have reached. This makes the prefilter ordering executable and fixes the semantic path so the source fence reaches the actual vector-scoring boundary.

Usage

Consumers keep the stable Docbank identity triple and compute the currently authorized bounded source fence before each query. Pass that fence to document search, then recheck source visibility immediately before presenting a result. Do not persist Docbank chunks, vectors, or rendition IDs as a second consumer-owned search authority.

Refs #176

Stacks on #235.

[roborev-ci]

roborev: Combined Review (6889072)

Verdict: One medium-severity issue requires attention; no critical or high-severity findings were identified.

Medium

• internal/processing/service.go:1358-1365 — Omitting BindingID silently selects the first embedding binding. Semantic or hybrid searches with multiple bindings may query an unintended vector space. Reject omitted bindings when multiple embedding bindings exist, matching CLI behavior.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 27m33s