fix(organization): bind issuance validation and seal to one snapshot

[seonghobae]

Finding

OrganizationHierarchyChangeReviewPacket.__post_init__() previously validated semantic fields from the live object and only afterwards reread them for creation sealing. A retained raw packet reference could therefore change an exact-built-in semantic value after its validator ran but before creation evidence was captured.

#280 owns semantic issuance validation → creation digest/correlation sealing on one identical snapshot. Post-issuance export integrity is #279; same-object lifecycle is #281; authoritative audit-clock provenance is #282/#119; ordinary module-level registry mutation capability is #283.

RED → repair

Canonical owner remains PR #96.

• test-first regression 648d59fd18e63e4ba8e129e851e9614a8f2b7f23
• finalized invariant regression 261a67d56e0c235b29b070afbe6ea4b2b99ab02a
• causal source repair 08ff578c7a8fb659bd3a4824e439d0360b2a1963
• first ADR/TRACEABILITY/README/package CHANGELOG alignment 8243383ef33e9c75ce6232c0d06209186e4c08ca
• fix(organization): seal post-issuance export representation and snapshot consistency #279/fix(organization): prevent hierarchy review packet reissuance #281/fix(organization): attest hierarchy-review recorded_at provenance #282 repairs and fix(organization): hide hierarchy-review issuance registry mutation capability #283 closure-private state hardening are preserved on the same ordinary-forward owner lane

The causal repair captures every trust-bearing field once into one issuance snapshot, validates the complete semantic contract against that snapshot, canonicalizes only those values, and derives creation digest plus tenant-qualified live-reference key from the same snapshot. Canonical export independently retains #279's checked-versus-used protection.

Root release-truth contract preserved

The current #96 descendant also carries the deterministic root CHANGELOG contract for the active Organization hierarchy-review package. It remains branch-local release truth, not a published release or mutation authority.

Current exact-head acceptance — 2026-09-10

PR #96 is exact 0262d70eaac37e2ab4096c67894a0bae71a4b1d2, directly based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, open · Draft · mechanically mergeable.

Exact-head leaf/source evidence is GREEN: Foundation 34369393258 / job 102526382630, SAST 34369393198, Required OpenCode job 102527871752, and Required Noema job 102527471651 are SUCCESS. Fresh reviews remain COMMENTED-only with no qualifying independent APPROVED; every visible inline thread is resolved.

Required shared lanes are independently non-passing/nonterminal:

• Security 34369393189: dependency-review job 102526931585 fails closed before the pinned action. Canonical owner .github#810, current exact-head canary 5604514013.
• CodeQL 34369393184: Actions consumer 102526616445 and Python consumer 102526617050 terminal-fail before authoritative dispatch 102528422966 starts and succeeds. Canonical proposed repair .github#2040, current exact-head canary 5604510396.
• Strix 34369390074 / job 102527232339: genuinely IN PROGRESS in Run Strix (quick) after successful exact-head admission/materialization, workflow self-test, credential gate, CO sidecar, Strix install and orchestrator/free input preparation. Report/status steps have not run, so no security/provider verdict is inferred.

No predecessor verdict transfers, local workflow workaround, synthetic status, self-approval, force push, destructive rebase or administrator bypass.

Acceptance

Keep this issue open until #96 or a verified successor carrying the complete #280 test/source/docs/root-release-truth delta integrates normally into protected develop, with exact-head owned coverage and all then-live central workflow/review governance satisfied. #279/#281/#282/#283 retain their separate invariants.

[seonghobae]

Current-descendant authority update: canonical #96 is now exact 0262d70eaac37e2ab4096c67894a0bae71a4b1d2. #280 continues to own issuance semantic-validation→creation-sealing one-snapshot integrity; that invariant is unchanged. New sibling #283 is separate and closes ordinary module-level mutation capability over the process-local issuance registries. Its executable lineage is hosted RED 4105ff... / Foundation 34368435932 job 102523127294 → causal source 1e999... / Foundation GREEN 34368952870 job 102524889637 → docs/current-evidence descendant 0262d70.... Final-head SAST is GREEN; other required lanes are still nonterminal, so no predecessor acceptance is transferred. Keep #280 open through normal protected integration/full successor.

[seonghobae]

Current exact-head authority update — 2026-09-10

#280's issuance checked-versus-used invariant remains preserved on canonical #96 exact ff16a08dc035faf05dc1b921e947b1cf82cfb36e over protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; the older 0262d70... acceptance text is historical. Current Foundation 34396350836/102616940695, SAST 34396351089/102617040740, OpenCode 34396347572/102617074947, merge scheduler 34396347450/102616910003, and Noema 34396347445/102617027671 are SUCCESS. Security 34396350675/102617027944 remains fail-closed on .github#810 (HTTP 403 Dependency Review availability), CodeQL 34396350863 remains non-passing on .github#2040 settlement ordering, and Strix 34396347513/102617064104 is mechanically SUCCESS but non-authorizing because immutable artifact 10122149854 has empty SARIF, a 307-byte template-only report, and no exact target/base/head/scope/finding-set receipt. Canonical Strix evidence owner .github#891 has canary 5607965106; implementation PR .github#1563@20913979589d86ad1e2d26705ffb2c4a675409bd is still unintegrated.

Fresh #96 reviews contain no qualifying independent APPROVED; all visible inline threads are resolved. Keep #280 open until #96 (or a verified complete successor) normally integrates. No predecessor evidence, bypass, self-approval, force push, destructive rebase, or gate-name-only success is accepted.

[seonghobae]

Current-authority correction after ordinary-forward #287: canonical owner #96 is now exact 6e5784b77e4dc00f15fd6e072dc61babd85d5910 over protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. #280's issuance one-snapshot semantic-validation→creation-seal invariant remains unchanged and is preserved in ancestry. #287 separately binds the direct snapshot/payload/serializer/live-reference-constructor module selections used around that invariant. Fresh exact-head Foundation/SAST/Security/CodeQL are queued; predecessor verdicts do not transfer. Reviews remain COMMENTED-only with no qualifying independent APPROVED. Keep #280 open through normal #96 protected integration.