feat(data-quality): add bounded batch evaluator runtime

[ammarheidari]

Authority

W65 / #214 is ACTIVE. Slice 1 bounded policy/evidence contracts and Slice 2 evaluator/progress contracts are protected-main verified.

Slice 3 scope

• implement IDataQualityBatchEvaluator over an already-authorized, finite DataQualityEvaluationInput;
• reuse existing IRecordDecodePort for structured value decoding;
• evaluate only the admitted closed rule grammar:
  • RequiredPath
  • NullForbidden
  • ValueType
  • NumericRange
  • StringLengthRange
• emit aggregate violation counts + metadata-only progress;
• preserve source/decode/timeout/cancel truth as Partial/Unavailable rather than fabricated zero;
• enforce exact policy scope and policy throughput budget;
• no persistence/worker/API/UI activation in this slice.

Safety

• no Kafka consumer-group membership or offset commits;
• no hidden record reads: evaluator receives an already-bounded batch only;
• no arbitrary scripts/CEL/JQ/regex/user code;
• no raw key/value/header durability;
• decode/provider failure never becomes a fabricated violation;
• tombstones are evaluated without persisting or decoding payload bytes.

Exact head: d22fecef89a86440a529ebb589d5d39ee04903c8.

Refs #214 #209.

Corrective exact-head

• fixed Slice 2 snapshot semantics so nullable Kafka key/value remain null instead of becoming empty ReadOnlyMemory<byte>;
• added contract regression coverage for tombstone/null preservation;
• runtime evaluator now evaluates tombstones without invoking decode;
• source is frozen pending fresh exact-head CI, CODEOWNER and Codex review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T15:15:45.536215Z	d22fece	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ammarheidari]

@codex review

Please review exact head 927d8f3ad1cc129a521e5db4aba1445deed04fe6 only. Focus on W65 Slice 3 bounded evaluator semantics: exact policy scope, closed rule grammar, decoder/source failure truth, partial/unavailable aggregation without fabricated violations, progress cursor/counter correctness, throughput/deadline bounds, and absence of raw-payload persistence or hidden Kafka reads.

[ammarheidari]

@codex review

Please review exact head d22fecef89a86440a529ebb589d5d39ee04903c8 only. The prior CI failure exposed and corrected a Slice 2 nullable snapshot bug: null Kafka key/value are now preserved as null rather than empty memory. Please review the bounded evaluator plus this contract correction for scope, progress/counter truth, decoder/source failure semantics, tombstones, deadlines/budgets, and absence of raw-payload persistence or hidden Kafka reads.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d22fecef89

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Recheck the deadline after decoding each record

If the final record starts decoding before the deadline but the schema lookup or synchronous deserialization finishes after it, this method immediately evaluates the rules and returns Complete because there is no subsequent loop iteration to perform another deadline check. The concrete ConfluentRecordDecoder checks expiry before its potentially expensive lookup/decode work, so passing the deadline downstream does not prevent this case; recheck the effective deadline after the await and report DurationLimit without counting the unfinished record.

Useful? React with 👍 / 👎.

[ammarheidari]

Closing as superseded. The Slice 3 runtime evaluator was admitted through PR #250 and its post-merge correctness findings were resolved in corrective PR #251. Keeping #249 open would duplicate an already-protected-main implementation path. No changes from this stale head should be merged.