fix(mrl): reconcile training lineage identity on canonical main

[TheHalfMoon]

Summary

Reconcile MRL-0601 TrainingExampleLineageContract construction-identity hardening onto canonical main after #304 merged.

This replacement carries only the final intended content from superseded PR #305, rebuilt directly from canonical main without rebase, force-push, or destructive history rewriting.

Repair

• make TrainingExampleLineageContract weak-referenceable without adding caller-supplied fields
• bind the exact construction-time lineage content identity outside reachable object state
• rebuild one complete TrainingExampleV1 snapshot before public lineage trust/semantic/hash views
• reject malformed mutation and coordinated mutation to another syntactically valid source/example identity
• preserve metadata-only, no-source-access, no-training-authority, and no-promotion-authority semantics

Exact qualified candidate

• canonical base: 613f48cd03493e9bb92e8b5328b0d4fd4f372907
• exact head: 26d66b718a359f33cc028dc93d9f2fdc8088bae1
• live compare: behind_by=0
• exact scope: two intended files only
  • src/medscale/mesc/_mrl_training_example_lineage_v1.py
  • tests/test_mesc_mrl_training_example_lineage_v1.py

Exact-head qualification

CI run 33356665267: PASS.

Both Python 3.11 and Python 3.12 lanes passed:

• locked dependency sync
• Ruff lint
• Ruff format
• strict mypy
• full pytest/coverage
• MRL machine-state drift/manual-edit gate
• medscale check

CodeQL run 33356665319: PASS.

Final exact-head semantic review found no unresolved material defect. GitHub reports no inline review threads or submitted review findings. Qodo remains billing-blocked and CodeRabbit automatic review is disabled for this repository; neither paid review usage nor human review was requested.

Downstream reconciliation

After this becomes canonical, PR #299 must be reconciled so MRL-0602/MRL-0603/MRL-0605 validate the original construction-bound lineage. PR #295 remains downstream of that reconciliation.

Boundary

This is fail-closed lineage-metadata integrity hardening only. It reads no source bytes or corpora, accesses no model/provider/network/GPU/runtime, executes no generation or training, and grants no source/data access, training, promotion, deployment, release, or clinical authority.

Guarded merge is authorized only while canonical main remains the stated base and the PR head remains exactly 26d66b718a359f33cc028dc93d9f2fdc8088bae1. No force-push, rebase, destructive history rewrite, CI/CodeQL weakening, governance bypass, provider spend, or real-asset access was used.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e4b58f91-ee63-4228-be16-e8ba020ded17

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}