fix(mrl): bind and revalidate Tier 1 budget policy

[TheHalfMoon]

Summary

Harden MRL-0302 Tier 1 adaptive-budget policy and usage state against malformed post-construction mutation and coordinated mutation that remains syntactically valid.

Manual semantic review identified a remaining budget-integrity defect after the earlier negative-counter repair: a caller could mutate a legitimate Tier1ExposureUsage(queries_used=5) to queries_used=0 and restore consumed capacity because the altered value remained non-negative and within the frozen ceiling.

Repair

• bind the exact construction-time TierEvaluationContract.content_sha256 for Tier1ExposurePolicy outside reachable object state
• revalidate the current tier contract and reject objective/tier identity drift before reading ceilings, exposure policy, serialization, or consuming capacity
• bind the exact construction-time (queries_used, exposures_used) pair for every Tier1ExposureUsage outside mutable dataclass fields
• revalidate usage through a fresh construction-bound snapshot before every query/exposure operation
• reject malformed negative counters before use
• reject any valid post-construction usage-counter drift before query/exposure consumption
• preserve SEARCH-only boundaries, frozen upper ceilings, result-field allow-list, and non-authoritative semantics

Regression coverage

• mutated negative query/exposure counters fail closed
• valid counter decreases cannot restore consumed query or exposure capacity
• policy objective mutation cannot enlarge the bound Tier 1 budget
• policy and usage construction identities are not exposed as mutable dataclass fields

Canonical base

bf92dd2977d24aa597d2442decabc215f7bd3dbf

Exact candidate head

17dd2d3a51d4df3a75a733fca1acbfcaffff7d8c

Live compare: behind_by=0, 10 commits ahead, exactly two intended files:

• src/medscale/mesc/_mrl_tier1_exposure_v1.py
• tests/test_mesc_mrl_tier1_exposure_v1.py

All qualification/review evidence for earlier heads, including c13261cf0d426eb12c06cbcea99f38c55ebac164, is stale.

Current exact-head qualification blocker

Fresh automatic workflows terminate before any workflow step executes:

• CI run 33301198900
  • Python 3.11 job 99229566629: failure, steps=null
  • Python 3.12 job 99229566717: failure, steps=null
• CodeQL run 33301198895
  • analyze (python) job 99229566462: failure, steps=null

These are external pre-execution hosted-runner blocker results only. They are not Ruff, formatting, strict mypy, pytest/coverage, MRL machine-state, medscale check, or CodeQL-analysis results and do not authorize merge.

Boundary

This is fail-closed budget-integrity hardening. It grants no new budget, execution, model/data/network/GPU, training, promotion, deployment, release, or clinical authority.

Fresh exact-head CI, CodeQL/security qualification, intended-scope verification, review, behind_by=0, mergeability, and zero unresolved material findings/threads remain required before guarded merge. After MRL-0301 hardening in PR #304 becomes canonical, this branch must be reconciled against that exact canonical implementation and fully requalified. No force-push, rebase, destructive history rewrite, governance bypass, provider spend, or real-asset access is used.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: fb084223-2ca6-46c7-8f18-e0fa10edc9c9

📥 Commits

Reviewing files that changed from the base of the PR and between bf92dd2 and 17dd2d3.

📒 Files selected for processing (2)

• src/medscale/mesc/_mrl_tier1_exposure_v1.py
• tests/test_mesc_mrl_tier1_exposure_v1.py

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[TheHalfMoon]

Exact-head qualification blocker update for 90d97533d28c2a86ce8988ea3eda69d9849ac398:

• CI run 33264099471
  • Python 3.12 job 99130933084: failure, steps=null
  • Python 3.11 job 99130933214: failure, steps=null
• CodeQL run 33264099473
  • analyze (python) job 99130933054: failure, steps=null

No workflow step executed on this exact candidate head, so these red jobs are pre-execution hosted-runner/account-capacity evidence, not Ruff, formatting, mypy, pytest/coverage, machine-state, medscale check, or CodeQL-analysis failures. This comment is blocker evidence only: it is not a PASS and does not authorize merge. Fresh exact-head repository qualification remains mandatory.

[TheHalfMoon]

Superseded first by PR #306's reconciliation path and now by canonical main, which already contains the Tier 1 construction-bound policy/usage hardening. Closing this historical candidate without merge; none of its stale qualification evidence is reused.