[shivros]

Summary

Implements COD-499's generic path_equals matcher for literal nested object-key paths in normalized RiteEvent values.

• Adds typed path_equals = { path = [ ... ], value = ... } parsing and exact JSON-type equality.
• Preserves scalar legacy path_equals metadata leaves and existing all_of / any_of / not semantics.
• Rejects empty paths, empty segments, unknown predicate fields, structured expected values, and unsupported path shapes at configuration load.
• Adds real Iris SSE fixture dispatch coverage for source identity, installation allowlists, semantic event kinds, direction, content consent, missing/mistyped provenance, same-text false positives, and replay selection.
• Verifies list_handlers and get_handler preserve the declaration through the generated public dispatch surface.
• Documents and examples the source-neutral inbox selection rule without adding durable receipt, authorization, deployment, or notification behavior.

Verification

• cargo build --all-targets
• cargo test --all-targets — 63 tests passed
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p rite-codegen -- check
• creed diff
• git diff --check

All local gates passed at commit 35dd5a3e6749c69d2849a7380f2af470131b0f12.

Scope boundary

This PR only adds deterministic configuration matching and its evidence. It does not implement durable receipt/checkpoint state, authorization, retries, deployment, release, or live notification delivery.

[shivros]

🤖 Automated Review Panel

Reviewer A — Codex / gpt-5.6-terra

Final: APPROVE

• Initial review found one MAJOR documentation/example gap: the shipped inbox-attention examples did not include the original source-identity predicate at [ "metadata", "message", "source" ] = "agent_hook".
• Resolution: added that literal path_equals guard to both README.md and rite.example.toml in the final committed head.
• Follow-up review verified the authoritative final diff and found no remaining correctness or goal-alignment blockers.

Reviewer B — Gemini 3 Flash / OpenRouter

Final: APPROVE

• Literal-key traversal and strict scalar type matching are correct.
• Configuration validation rejects malformed paths, empty segments, unsupported fields, and non-scalar values.
• Scalar legacy path_equals leaves and existing compound matching remain compatible.
• Real Iris fixture dispatch and generated list_handlers/get_handler coverage demonstrate the requested provenance filtering and declaration preservation.

Review evidence

• Final diff: git diff origin/main...HEAD
• Final diff SHA-256: 4e8bf4965e6df56e99a3ef9a139421a9a338abbc6719b63926db2964776f4c0a
• All required local gates passed at 35dd5a3e6749c69d2849a7380f2af470131b0f12.

[shivros]

Auto-Merge Gate

Confidence: 0.94

COD-499's literal nested-key path_equals predicate is implemented in the existing condition tree, preserves legacy scalar path_equals leaves and compound matcher behavior, validates malformed configuration on load, and is covered through real Iris fixture dispatch plus generated handler views.

Independent verification: cargo test --all-targets (63 passed), cargo clippy --all-targets -- -D warnings, cargo fmt --all -- --check, cargo run -p rite-codegen -- check, and git diff --check origin/main...HEAD all passed at 35dd5a3e6749c69d2849a7380f2af470131b0f12.

GitHub checks: CI test and Creed context drift succeeded. The linked Linear ticket has no manual-review or do-not-merge marker; its stated remaining work is review/merge only. Scope excludes deployment, release, durable receipt state, authorization, retries, and live delivery.