feat(app-builder): enforce complete replay identities

[kattsushi]

Closes #132

Part of #131.

Summary

• bind complete ordered output identities into replay provenance
• reject coherent evidence tampering and candidate identity drift before workspace reads
• preserve valid zero-diff replay with fail-closed coverage

Changes

File	Change
packages/app-builder/generation/src/provenance.ts	Capture authoritative output identities and bind them into provenance digests.
packages/app-builder/generation/src/replay.ts	Validate recorded evidence and exact candidate identities before observing outputs.
packages/app-builder/generation/tests/replay.test.ts	Cover truncation, coherent reorder, identity-field drift, zero reads, and valid zero-diff replay.

Test plan

• pnpm nx run @effectify/app-builder-generation:test — 20/20 passed
• pnpm nx run @effectify/app-builder-contracts:build
• pnpm nx run @effectify/app-builder-generation:typecheck
• pnpm format:check
• git diff --check
• Fresh read-only validation passed

Contributor checklist

• Linked an approved issue
• Added exactly one type:* label
• Tests included with the behavior
• Conventional commit format
• No Co-Authored-By trailers

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b6639343-fcfd-4984-bb5f-4c822341b2d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}