feat(mrl): add independent procedure admission gate

[TheHalfMoon]

Summary

Implement MRL-0406 on canonical main after MRL-0404/MRL-0405 became canonical through PR #315.

This change closes the gap between well-formed procedure admission labels and actual independent, evidence-bound review authority.

Independent review trust root

• add a repository-controlled procedure-review trust registry
• production trust starts empty: well-formed reviewer strings or receipt hashes cannot manufacture authority
• bind public trust operations to private lock-aware registry state
• bind each review admission to an expected registry identity and exact review-receipt content digest
• prevent trust replacement during an active admission lease
• provide a private deterministic test-only registry replacement path; it is not exported as production authority

Trust binding hardening

• the admission evaluator captures the canonical review-trust lease callable in a lexical closure at import time
• the original module-level trust import is deleted after binding
• rebinding an ordinary module-level trust name after import cannot bypass the admission evaluator
• focused regression coverage attempts that rebinding and proves the production-empty trust root still fails closed

Procedure review receipt

• construction-bound independent review artifact
• reviewer kind must be INDEPENDENT_REVIEWER or OPERATOR
• binds exact procedure admission-subject identity
• binds exact typed applicability bounds
• binds exact replay, representative-transfer, and negative-control evidence identities
• permits only explicit ADMIT or REJECT
• cannot authorize itself or model promotion

Admission gate

• reuses canonical ResearchProcedureAdmissionReport
• revalidates canonical MRL-0403 replay, MRL-0404 transfer, and MRL-0405 negative-control evidence
• requires all representative transfer cases to reproduce and all declared negative controls to pass
• requires the independent review receipt to bind the exact same evidence and applicability
• checks lexically bound repository review trust only after evidence integrity succeeds
• REJECT terminates at REVIEWED
• trusted ADMIT creates the exact DISCOVERED -> CANDIDATE -> REPLAYED -> TRANSFER_TESTED -> REVIEWED -> ADMITTED chain and admitted procedure binding
• result views revalidate original nested evidence and construction identity

Canonical base

06ea81ff61bb78ccc28709ab82e40056f4cf7f3c

Exact qualified head

a857f36dfdd2932ff6c9d11046d4358995464256

Live compare: behind_by=0, exactly four intended source/test files; all temporary workflows and trigger files are absent from the effective diff.

Exact-head qualification

PASS on a857f36dfdd2932ff6c9d11046d4358995464256:

• Python 3.11 quality: SUCCESS
• Python 3.12 quality: SUCCESS
• Ruff lint: SUCCESS
• Ruff format: SUCCESS
• strict mypy: SUCCESS
• full pytest/coverage: SUCCESS
• MRL machine-state drift/manual-edit gate: SUCCESS
• medscale check: SUCCESS
• CodeQL analyze (python): SUCCESS
• behind_by=0
• unresolved review threads: 0

No evidence from any earlier #316 head is reused.

Scope

Exactly:

• src/medscale/mesc/_mrl_procedure_review_trust_v1.py
• src/medscale/mesc/_mrl_procedure_admission_gate_v1.py
• tests/test_mesc_mrl_procedure_review_trust_v1.py
• tests/test_mesc_mrl_procedure_admission_gate_v1.py

Boundary

This gate grants only governed procedure-memory admission after trusted independent review. It grants no model/data/network/GPU/inference/training/promotion/deployment/release/clinical authority. Production review trust remains empty until a separate canonical governance change provisions an exact receipt digest.

No force-push, rebase, destructive history rewrite, CI/CodeQL weakening, governance bypass, provider spend, or real-asset access is used.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d61be27-4602-4b90-8068-2bf92b18df48

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[TheHalfMoon]

Exact-head qualification PASS for a857f36dfdd2932ff6c9d11046d4358995464256. Python 3.11/3.12 quality, Ruff lint/format, strict mypy, full pytest/coverage, MRL machine-state gate, medscale check, and CodeQL all succeeded. Live compare is behind_by=0, scope is exactly the four intended MRL-0406 source/test files, and unresolved review threads are zero. Manual semantic review also confirms the review-trust callable is lexically bound and the production trust registry remains empty. No earlier-head evidence is reused.