Function validate_commit_request 

pub fn validate_commit_request(
    request: &CommitImportJobRequest,
    resolved_provider: &str,
    current_source: &ProviderRepository,
    configuration: &GetImportConfigurationResponse,
) -> Result<(), Reject>

Source association/provider comes from the host’s authenticated resolver, never a projection hint. Native base decoding/identity and current grants remain host gates; this validates carrier, bounds and exact originals.