fix(organization): attest hierarchy-review recorded_at provenance

[seonghobae]

Finding

PR #96 previously described recorded_at as system-recorded review-evidence time even though the leaf package accepts it as a public caller/invoking-boundary value. The executable leaf contract proves canonical fixed-offset shape and rejects future issuance values; it does not prove that an internal Orgmetra system clock generated the timestamp. Arbitrarily old caller-supplied values remain structurally admissible by design.

That distinction is material for audit evidence. The durable application/persistence boundary must keep business effective_on, packet review-evidence recorded_at, and authoritative system/database audit time separate.

Ownership boundary

• feat(core): add governed Organization hierarchy-change review #96 remains the single writer for the Organization hierarchy-review packet. d1e57c2d14fc28309b51a3ddf7ec28d4a5726f02, f84dcb64b51dc492af938a4bdd0836354b1a4496, and 0e69f0799898b7e19edcf19bca2d2cf6483f65fe remove wording that overclaimed caller-supplied review evidence as authoritative system time. Runtime behavior is unchanged by those terminology repairs.
• feat(core): apply reviewed Organization hierarchy changes #119 remains the application/persistence owner. After feat(core): add governed Organization hierarchy-change review #96 integrates and feat(core): apply reviewed Organization hierarchy changes #119 non-force adopts protected develop, its mutation transaction must generate or attest authoritative system-recorded audit/outbox time from the system/database boundary rather than treating packet recorded_at as durable transaction-time authority.
• fix(organization): hide hierarchy-review issuance registry mutation capability #283 independently hides the leaf's process-local issuance-registry mutation capability; that process-local state still does not establish clock provenance or durable authority.
• Do not add an arbitrary freshness window, export-time wall-clock dependency, mutable cross-branch dependency or caller-spoofable trusted-time token in the leaf package.

Root release-truth contract preserved

The current #96 descendant also carries the deterministic root CHANGELOG contract for the active Organization hierarchy-review package. It records branch-local product truth but does not authorize mutation or constitute a published immutable release.

Current exact-head acceptance — 2026-09-10

#96 is exact 0262d70eaac37e2ab4096c67894a0bae71a4b1d2, directly based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, open · Draft · mechanically mergeable.

Exact-head leaf/source evidence is GREEN: Foundation 34369393258 / job 102526382630, SAST 34369393198, Required OpenCode job 102527871752, and Required Noema job 102527471651 are SUCCESS. Every visible inline review thread is resolved; fresh submitted reviews remain COMMENTED-only with no qualifying independent APPROVED.

Required shared/runtime lanes remain independent:

• Security 34369393189: dependency-review job 102526931585 fails closed before the pinned action. Canonical owner .github#810, exact-head canary 5604514013.
• CodeQL 34369393184: Actions consumer 102526616445 and Python consumer 102526617050 terminal-fail before authoritative dispatch 102528422966 starts and succeeds. Canonical proposed repair .github#2040, exact-head canary 5604510396.
• Strix 34369390074 / job 102527232339: genuinely IN PROGRESS in Run Strix (quick) after successful admission/materialization/CO-sidecar/install/orchestrator/free input preparation. Report collection/upload and same-head publication remain pending; no elapsed-time/provider/security verdict is inferred.

docs/product-technical-gap-baseline.md remains #100's single-writer. No predecessor verdict transfer, local required-workflow shim, synthetic status, self-approval, routine administrator bypass, force push or destructive rebase.

Acceptance

Keep this issue open until #96 integrates normally, #119 adopts protected truth non-force and proves the authoritative system-generated audit/outbox timestamp boundary, and all then-current exact-head gates/governance pass. Documentation on a mutable PR head is not closure.

Refs #96 #119 #100 #283.

[seonghobae]

Owner-path update: #96 ordinary-forward documentation lineage is now 005c8854e69a17fbc93eb24b32c5978fd2e09730 (doctoring/AU-8) → ddcf29adf1a0ed886dc775f6e5fecd72e40a64d4 (package README) → c8c11911c1b43c28bf40279f0632b4a4040769e5 (TRACEABILITY) → 9b1184eca321f0b752576ba9d5f4799eb3b1df46 (ADR 0096) → exact current a09d2eb30df2eb00d79ef689d489643aabcc9233 (package CHANGELOG). Source behavior is intentionally unchanged: this is a truth/ownership correction, not an arbitrary freshness-window patch. #119 authority now explicitly requires its post-parent-integration transaction to generate/attest authoritative system/database-clock audit/outbox time separately from packet recorded_at. #100 baseline single-writer received durable handoff comment 5598498972. Current-head #96 workflows are newly admitted/nonterminal and predecessor verdicts do not transfer. Keep #282 open through protected parent integration and downstream authoritative clock implementation/evidence.

[seonghobae]

Current-descendant authority update: #96 is exact 0262d70eaac37e2ab4096c67894a0bae71a4b1d2; #282's clock-provenance split is unchanged. New #283 only moves process-local issuance state behind closure-private packet methods and does not promote leaf recorded_at or any in-process registry into authoritative transaction-time/durable HRIS truth. #119 authority has been updated accordingly and remains stale-parent Draft/conflicting until normal #96 protected integration. Hosted #283 lineage: RED 4105ff... Foundation 34368435932 / 102523127294; causal GREEN 1e999... Foundation 34368952870 / 102524889637; current docs/evidence descendant 0262d70..., whose final required checks are still partly nonterminal.

[seonghobae]

Current exact-head authority update — 2026-09-10

#282's provenance boundary remains unchanged and preserved on canonical #96 exact ff16a08dc035faf05dc1b921e947b1cf82cfb36e: leaf recorded_at is invoking-boundary review evidence, not authoritative system/database transaction time; #119 still owns authoritative application/audit/outbox time after protected #96 integration. The older 0262d70... workflow snapshot is historical.

Current exact-head Foundation 34396350836/102616940695, SAST 34396351089/102617040740, OpenCode 34396347572/102617074947, merge scheduler 34396347450/102616910003, and Noema 34396347445/102617027671 are SUCCESS. Security 34396350675/102617027944 remains fail-closed on .github#810; CodeQL 34396350863 remains non-passing on .github#2040; Strix 34396347513/102617064104 is mechanically SUCCESS but non-authorizing because artifact 10122149854 has empty SARIF, a 307-byte template-only report and no exact target/base/head/scope/finding-set receipt (.github#891, canary 5607965106; central implementation .github#1563@20913979589d86ad1e2d26705ffb2c4a675409bd is not protected truth).

Fresh #96 reviews remain COMMENTED-only with no qualifying independent APPROVED; all visible inline threads are resolved. Keep #282 open through #96 normal integration and subsequent #119 non-force protected adoption proving authoritative system-generated audit/outbox time. No arbitrary leaf freshness window, predecessor evidence, bypass, self-approval, force push, destructive rebase, or gate-name-only success.

[seonghobae]

Current-authority correction after #287: #96 is exact 6e5784b77e4dc00f15fd6e072dc61babd85d5910 over protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. #282's boundary is unchanged: packet recorded_at is invoking-boundary review evidence, while #119 must generate or attest authoritative application/audit time in durable mutation/persistence. #287 affects only direct issuance helper/module-binding authority and does not alter clock provenance. Fresh exact-head workflows are queued; no predecessor verdict transfers and no qualifying independent APPROVED exists. Keep #282 open through #96 protected integration and #119 durable-clock acceptance.