fix(selection-monitoring): bind post-issuance validation and export to one snapshot

[seonghobae]

Finding

Selection Monitoring had two distinct post-issuance integrity gaps in the same canonical-export boundary.

The first was representation-preserving runtime aliasing: after issuance, low-level mutation could replace an exact built-in trust field with a behavior-bearing subtype carrying the same serialized value. That gap was repaired on PR #42 before this update by re-establishing exact built-in runtime types before canonical rendering.

A second checked-versus-used gap remained. At 155c9cdc9586ac29bdc4ace8a718fba3ab6304a5, _assert_canonical_runtime_evidence(plan) read and validated live object fields, then _canonical_plan_json_unchecked(plan) reread those fields for rendering. Another thread could therefore mutate monitoring_start after validation but before .isoformat(), substituting caller-controlled subtype behavior into the export that had just passed the type gate.

Reality RED

Test-only exact a08e12cb246a31f7ec6f9026b3f1fc5bade07930 adds a deterministic barrier after runtime validation, then replaces monitoring_start with an executable date subtype before rendering resumes.

Foundation CI 34355327114, job 102478423049, materialized the real RED on that exact head: the Selection Monitoring package ran 123 tests and finished 1 failed, 122 passed because test_canonical_export_uses_the_same_runtime_snapshot_it_validated observed AssertionError("caller-controlled date method executed"). The RED head still reported 100% owned statement and branch coverage, so this is a behavioral integrity failure rather than an uncovered path.

Causal repair

Exact source repair e5a53ca440ac7ed38049095afdf39bef34591078 introduces one captured canonical runtime-evidence dictionary. Canonical export now:

1. reads each serialized trust-bearing field exactly once;
2. exact-type validates that captured snapshot;
3. renders date/timestamp/JSON exclusively from the same snapshot;
4. compares those canonical bytes with the original process-local issuance seal.

A subtype present at capture fails closed before caller-controlled rendering. A mutation after validation cannot alter the already-captured value used by that export. A subsequent export sees the new live value and fails the exact-type boundary. Valid canonical JSON/schema and the public builder contract are unchanged.

Foundation CI 34355550242, job 102479182632, completed SUCCESS on exact e5a53ca440ac7ed38049095afdf39bef34591078, including Foundation dependency hygiene, owned unit/service contracts, isolated PostgreSQL contracts, and read-only validation.

Documentation successor 6749ea11063c091a1aa8af1714af5e088cb4a3db updates ADR 0016, Selection Monitoring traceability, README, and package CHANGELOG so the one-snapshot invariant is code-current. Its exact-head workflows are fresh and must be judged independently; predecessor GREEN does not transfer.

Canonical owner / acceptance

PR #42 remains the sole Selection Monitoring writer, based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Preserve aggregate-only scope, human-only consequential authority, exact 100% statement/branch coverage, privacy/issuance regressions, and current Foundation dependency order. Do not restore a package-local workflow, weaken the seal/type boundary, or copy mutable shared Foundation source.

Keep this issue open until PR #42 is normally integrated to protected develop, or a verified successor demonstrably carries every valid source/test/docs/evidence delta. Central required-workflow failures are repaired at their canonical owners rather than with leaf retries or gate weakening.

[seonghobae]

Test-first owner repair is now on canonical PR #42 without history rewrite.

• test-only RED contract: 06d8d2fbf8822f26758b810004dadbcf218c83e0
  • adds test_post_issuance_runtime_type_integrity.py;
  • same-value str subtype replaces an issued digest without changing canonical text;
  • executable date subtype replaces the issued business date and trips if .isoformat() is reached;
  • no hosted terminal RED is claimed: the short-lived test-only head had no materialized workflow run before the successor.
• minimal production successor/current feat: add governed selection outcome monitoring plan #42 head: c2a157d37f3a0bf6ac04f3ca2101a6607087e8f7
  • adds a canonical-export runtime evidence gate for every serialized trust-bearing text field and the exact date/datetime/int/bool field classes;
  • the gate executes before isoformat(), canonical timestamp rendering, JSON serialization, or HMAC comparison;
  • HMAC remains the semantic-byte tamper check; the new gate closes only its representation-preserving runtime-type blind spot;
  • valid public builder/schema/aggregate-only semantics are unchanged.

Net delta from predecessor ec35dc87... is 2 forward commits / 0 behind and only the Selection Monitoring production module plus its new regression file. Fresh current-head Foundation 34139613554, Security 34139613394, SAST 34139613429, and CodeQL 34139613460 are queued at this read. Keep #273 open until current-head owned coverage/hosted evidence is terminal and the #42 dependency/governance path is revalidated.

[seonghobae]

Documentation/authority synchronization completed by ordinary forward commits after the runtime fix. Current canonical #42 exact head is now 155c9cdc9586ac29bdc4ace8a718fba3ab6304a5 on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.

packages/selection-monitoring/README.md, package CHANGELOG, ADR 0016, and docs/traceability/selection-outcome-monitoring.md now state the same two-part integrity contract: (1) exact built-in runtime types must still hold before any canonical field behavior/serialization executes, then (2) the process-local HMAC verifies semantic canonical bytes. TRACEABILITY names the new same-value text/executable-date regression explicitly.

Current exact-head runs: Foundation 34140109476, SAST 34140109425, Security 34140109689, CodeQL 34140109611; all were queued at the latest read. Keep #273 open until current-head hosted package/coverage evidence is terminal; #42 itself remains Draft and still depends on #258/#259 protected Foundation ownership before integration.

[seonghobae]

Current acceptance update for canonical #42 exact 155c9cdc9586ac29bdc4ace8a718fba3ab6304a5: Foundation 34140109476 and SAST 34140109425 are terminal SUCCESS, so the representation-preserving runtime-alias repair has current-head executable/static gate evidence. Security 34140109689 fails only at the shared Dependency Review availability probe (.github#810), and CodeQL 34140109611 fails only in the central terminal-verdict ordering/publication path (.github#1929): both compatibility readers fail before a later same-run dispatch succeeds. No qualifying APPROVED review exists.

Keep #273 open through normal #42 protected integration or a verified successor carrying the same regressions. Do not reclassify central control-plane failures as a Selection Monitoring source RED, and do not churn the exact source head to retrigger them.