Story-3133

Citation checking through Indian Kanoon

Vani’s six citation tools now have a broker executor. Five use Indian Kanoon; court_weight is derived locally. The existing converse tool loop ends the first turn, performs the slow lookup, and re-invokes Vani with the broker-authored result.

The confidentiality boundary

Before any vendor request, the RLS-scoped matter service loads the current matter reference, title, case reference, client identifiers and contact details, and every party name. The egress boundary normalizes Unicode, case, and irregular whitespace and refuses a query containing any of those terms. Refusal happens before the HTTP client is called.

brain intent
  → broker authorization + matter RLS
  → protected-term denylist
  → non-VPC egress Lambda
  → scrub query
  → Indian Kanoon

Honest outcomes

A transport error, malformed payload, missing dependency, timeout, or empty internal response becomes exactly the two-key UNAVAILABLE object. A completed search with no record is non-empty and says only that the record was not found in the Indian Kanoon corpus. Source text containing the forbidden legal overclaim is also refused before it can reach Vani.

Record binding fixes the Vineeta Sharma failure

find_authority unions corpus results with model-proposed candidates, de-duplicates by Indian Kanoon tid, resolves each selected tid through /docmeta/, and only then reports the court carried by that bound search record. Results rank by later citing judgments.

The regression test presents both Delhi High Court 2018 and Supreme Court 2020 title matches. The court-and-year candidate constraint binds record 67965481, so the returned authority is Supreme Court 2020.

Measured source behavior and spend

Corpus search for daughters’ coparcenary rights returned tid=67965481, Supreme Court of India, 2020-08-11, 245 later citations: ₹0.50.
/docmeta/67965481/ returned identity and date but no court field, proving why the court must stay attached to the bound search row: ₹0.02.
One fragment hit and one miss established the response shapes: ₹0.10.
Three bounded history calls established citedby rows: ₹0.60.
A title search established the wrong-court failure mode: ₹0.50.

Fresh Story-3133 measurement spend: ₹1.72. Every runtime request logs its endpoint, duration, HTTP status, and paise; every logical lookup logs aggregate calls and paise. Queries and credentials are absent from logs.

Deployment boundary

The clerk worker remains in its no-NAT VPC and invokes the dedicated non-VPC egress Lambda over the existing Lambda service endpoint. The deploy workflow mutates code and code-owned configuration only and runs a canary that reads the exact Secrets Manager record and resolves known record 67965481. Terraform must own the Lambda shell, Secrets Manager read grant, and clerk-to-egress invoke grant.