Fuse provider evidence deterministically

[Khamel83]

Summary

• add pure bounded evidence fusion with version-authorized freshness and exact-window strict-empty proof
• cluster conservatively with lossless URL query identity and a pinned PSL snapshot identity
• rank with exact Fraction RRF, complete tie/contribution traces, and deterministic research diversity decisions
• retain grounding computed-answer artifacts outside web RRF while satisfying the contracted grounding floor
• enforce plan-provider membership, immutable ceilings, reserve-aware finite deadlines, and compatibility projection

Verification

• controller fusion/broker/attribution — 193 passed
• controller provider/evidence — 358 passed
• controller full suite — 1622 passed, 42 skipped
• scoped Ruff and git diff --check passed
• independent full-range review — Approved, no findings

Stack and gates

• stacked on S3 PR Finalize and compose extraction outcomes #89, S2 Normalize provider evidence batches #87, S1 Resolve deterministic retrieval plans #85, S0 feat: freeze accepted operation contracts #83
• no network, provider traffic, spend, persistence publication, or production activation
• human merge remains required

Resolves #90
Parent: #58

AI-generated implementation and PR description; independently reviewed and controller-verified.

[github-actions]

Fast review (openai/gpt-oss-20b:free, automated)

• The line netloc = display_host if port is N is cut off mid‑statement, causing a syntax error.
• The conservative_document_key function contains no return statement (the code after the broken line is missing).
• The file ends abruptly with an unfinished function body, leaving unclosed parentheses and missing indentation, so the module is not syntactically complete.

[github-actions]

Deep review (inclusionai/ling-3.0-flash:free, automated)

• Architecture: fusion.py is 1,150 lines and does normalization, filtering, clustering, ranking, diversification, empty-proof handling, input validation, and trace construction in a single module. The hardened public surface is good, but the monolithic structure makes unit tracing difficult; _validate_inputs is a single boolean-expression avalanche; _empty_outcome has 9 optional trace parameters, forcing callers to name everything even for partial traces; _APPROVED_CONFIDENCE, _FRESHNESS_PROOF_REGISTRY, and _SUCCESSFUL_EMPTY_REGISTRY are hardcoded provider tuples that need edits for any new provider. The diff also cuts mid-function in fuse_evidence, which is itself incomplete.
• Runtime edge cases: _normalize_percent re-encodes percent bytes that decode to reserved/control URI chars as uppercase (%2F instead of %2f), which changes the canonical key vs the raw input — downstream callers must accept case-normalized encoding. _site_key uses tld.get_fld with search_private=True, exposing private-suffix internals as site keys (intentional but leakage-prone). _validate_inputs swallows non-finite and bool-typed scalar inputs defensively, which is correct but the isinstance(…, bool) exclusion for publication_reserve_seconds is easy to miss in future additions. fuse_evidence requires an explicit utc_clock argument (no default), which is testable but unusual. The _conservative_document_key 8,192-char length guard is only applied at the URL-normalization stage, not at the input-batch level.
• Performance: _rank performs Fraction arithmetic for every RRF contribution; with 700 observations this dominates compared to simple float math. _diversify makes 4–5 linear passes over the ranked base to build selections, event lists, and non-selected decisions. _cluster sorts observations per group by (provider.value, provider_rank, url) while fusion_order_key compares against .encode("utf-8") — inconsistent total-order tie-breaking between clustering and final sort that could surprise trace stability. _validate_inputs walks batches three times (type check, provider identity check, observation count); one pass with accumulators would be cleaner. No memoization on _site_key or conservative_document_key across calls. The trace objects carry full per-event lists for every base candidate, which can bloat memory at the 700-observation ceiling relative to the small selected result set.

[github-actions]

Fast review (openai/gpt-oss-20b:free, automated)

(no response from model)

[github-actions]

Fast review (openai/gpt-oss-20b:free, automated)

(no response from model)