enhancement: define a validated evidence and confidence boundary for RAG and tool responses

[CoreyLeath-code]

Audit finding

TrojanChat documents optional Pinecone semantic search, yet repository searches returned no committed reasoning or confidence_score path. Retrieval and tool outcomes should not be presented as grounded or confidence-scored until an explicit, tested contract exists.

Evidence inspected

• README.md: documents optional Pinecone semantic search.

• tests/ and Python CI configuration are present.

• Searches for reasoning and confidence_score returned no code paths.

Proposed enhancement

Add optional chat-response metadata for retrieval attempted/succeeded state, safe source metadata only when actually retrieved, tool-execution outcome where tooling exists, and an insufficient-evidence state. Do not expose hidden reasoning, fabricate citations, or silently make retrieval failures look grounded.

Acceptance criteria

• Preserve current chat behavior when retrieval/tooling is disabled.

• Validate source schema and tool output before returning metadata.

• Add regression tests for retrieval miss, malformed source, tool failure, and no-evidence paths.

• Log request, retrieval, validation, and errors without prompts, secrets, or sensitive payloads.

• Document configuration, evidence limits, and confidence semantics.

NEEDS HUMAN DECISION

Choose a stable public schema/versioning strategy for chat metadata before clients depend on it.