fix(organization): bind hierarchy-review issuance semantic validator

[seonghobae]

Finding

Fresh review of canonical Organization hierarchy-review owner #96 found a distinct issuance-time integrity capability after #285 hardened post-issuance export. _build_packet_runtime().post_init() still resolved the module-global _validate_issuance_snapshot binding dynamically immediately before sealing. An ordinary same-interpreter consumer could replace that top-level semantic validator with a no-op and construct evidence that violates the mandatory requester/reviewer separation invariant. The later private creation seal faithfully preserved the invalid packet because the semantic gate itself had been bypassed.

This is separate from #279 export snapshot integrity, #280 checked-versus-used issuance snapshots, #281 same-object issuance lifecycle, #282 authoritative clock provenance, #283 private issuance state, #284 digest-verifier binding, and #285 post-issuance export-helper binding. PR #96 remains the single writer.

Reality RED → causal repair

Test-only ordinary-forward commit a0e616c68d5e194ecdb06089c6d83d8074fad833 added test_issuance_does_not_trust_mutable_module_validator_binding. Exact hosted Foundation 34395501352, job 102614084636, checked out that SHA, passed compilation, foundation validation, dependency hygiene, package setup and the reviewed test toolchain, then failed specifically in the installed-artifact hierarchy-review contract: 1 failed, 66 passed, Failed: DID NOT RAISE ValueError. Production statement and branch coverage remained 100.00%, so this is a semantic RED rather than a coverage artifact.

Minimal causal repair b48df4d71121387240ab23b9d475b0cce2b1f15e captures the top-level _validate_issuance_snapshot function when _build_packet_runtime() constructs the packet runtime and invokes that captured binding during issuance. Ordinary later replacement of the module name therefore cannot remove the mandatory issuance semantic gate.

Boundary

The repair is intentionally narrow. It does not claim a general anti-monkeypatch sandbox, freeze every transitive validation helper, prevent deliberate function-closure/global-dictionary introspection, or defend against arbitrary same-process/native code execution. Existing deterministic time/helper seams remain outside this finding unless a separate reality RED proves they can cross a trust boundary. Durable uniqueness, distributed authorization, authoritative transaction time, hierarchy concurrency and immutable audit/outbox persistence remain owned by #119 and authoritative HRIS persistence.

Acceptance

Keep this issue open until #96 or a verified successor carries the hosted RED, causal repair, code-current ADR/TRACEABILITY/README/CHANGELOG, exact-head 100% owned coverage, all required workflow evidence and a qualifying independent review, then integrates normally into protected develop. Do not simple-Close because branch-local source exists; do not replace exact-head evidence with predecessor checks or a gate-name-only success.

Refs #96 #119 #100 #279 #280 #281 #282 #283 #284 #285.

[seonghobae]

Current owner descendant is now #96 exact ff16a08dc035faf05dc1b921e947b1cf82cfb36e. Hosted RED remains a0e616c68d5e194ecdb06089c6d83d8074fad833 / Foundation 34395501352/102614084636 (1 failed, 66 passed, invalid same-actor evidence DID NOT RAISE; owned production statement/branch 100%). Minimal causal source repair is b48df4d71121387240ab23b9d475b0cce2b1f15e; current descendant adds ADR 0096, TRACEABILITY, README and CHANGELOG doctoring. Exact-head Foundation 34396350836/102616940695 is now terminal SUCCESS: exact checkout, installed-artifact #286 regression, owned unit/service contracts, isolated PostgreSQL contracts and read-only validation all passed; no manifest repair was needed. Current SAST/OpenCode/merge-scheduler are GREEN. Security remains fail-closed on exact Dependency Review HTTP 403 (34396350675/102617027944, central .github#810 comment 5607704292); CodeQL reproduces central settlement ordering (34396350863, .github#2040 comment 5607713135); Noema and Strix remain genuinely nonterminal on sidecar provisioning. No qualifying independent APPROVED exists, so keep #286 open with #96 Draft until normal protected integration rather than treating branch-local GREEN as delivery.

[seonghobae]

Current exact-head authority update — 2026-09-10

#286's issuance semantic-validator capture remains preserved on canonical #96 exact ff16a08dc035faf05dc1b921e947b1cf82cfb36e, directly based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, open · Draft · mechanically mergeable. The test-first hosted RED and causal repair recorded above remain the source-level evidence; this update supplies the current integration authority.

Current exact-head Foundation 34396350836/102616940695, SAST 34396351089/102617040740, OpenCode 34396347572/102617074947, merge scheduler 34396347450/102616910003, and Noema 34396347445/102617027671 are SUCCESS. Security 34396350675/102617027944 remains fail-closed on .github#810; CodeQL 34396350863 remains non-passing on .github#2040; Strix 34396347513/102617064104 is mechanically SUCCESS but non-authorizing because artifact 10122149854 has empty SARIF, a 307-byte template-only report and no exact target/base/head/scope/finding-set receipt (.github#891, canary 5607965106; central implementation .github#1563@20913979589d86ad1e2d26705ffb2c4a675409bd remains open/unintegrated).

Fresh #96 reviews contain no qualifying independent APPROVED; all visible inline threads are resolved. Keep #286 open until #96 or a verified complete successor normally integrates. The repair remains intentionally narrow process-local defense in depth; no claim is made that every transitive helper is immutable or that Python same-process execution is sandboxed.

[seonghobae]

Current-authority correction after #287: canonical #96 is now exact 6e5784b77e4dc00f15fd6e072dc61babd85d5910, direct protected base develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. #286's captured top-level issuance semantic validator remains intact. #287 separately captures the direct snapshot/payload/serializer/live-reference-binding selections that surround that validator so checked and sealed evidence cannot be redirected by later ordinary module reassignment. This still does not freeze transitive helper internals or create a same-process sandbox. Fresh exact-head workflows are queued; no predecessor verdict transfers and no qualifying independent APPROVED exists. Keep #286 open through normal #96 integration.