Finding
Draft #506 correctly requires RubinProjectionActivationReceiptV1.source_snapshot_id to be immutable and equal to the Analysis Run snapshot. However, the owner-controlled ApprovedRubinProjectionPairing previously bound generator/analysis/evidence/digest/availability/design/indicator but did not bind the authoritative source snapshot covered by that Validation Evidence.
That left a provenance gap in the future positive path: the same approved Validation Evidence ID/digest could be presented in a receipt for another immutable snapshot, and decide_with_registry would accept it so long as the caller's receipt snapshot equaled the runtime expected_snapshot_id. The registry had no way to say which immutable snapshot the approved evidence package actually validated.
The production registry is empty, so this is a pre-promotion repair rather than an active production authorization bypass. It still blocks adding any positive Rubin pairing until the surviving vehicle inherits and verifies the contract.
RED → causal repair
- RED:
e2e4f4597a1404b272f88d4bcd689816890864f9 adds a private-registry regression requiring an approved Validation Evidence package for immutable snapshot A to reject a receipt/runtime for immutable snapshot B. The RED intentionally references the missing owner-side snapshot field.
- Causal fix:
32aa83da55c75ab22ebbca8a903790be119cc20e adds source_snapshot_id to ApprovedRubinProjectionPairing, validates that owner snapshot as an immutable locator-safe identifier, and requires exact receipt/authority snapshot equality.
- Edge guard: the same regression verifies a mutable owner snapshot (
main) fails closed.
- Research contract currentization:
c4572953382e50d9c12735a500227ed4c9900a05.
- ADR 0034 currentization:
85ab06bb948149fd4a93d96f91b75f25f1cbaec4.
Current Draft #506 exact head is 85ab06bb948149fd4a93d96f91b75f25f1cbaec4, ordinary forward history on #504 exact parent 3d153b382e2382efb532f49bb1e2a8b93be0b73f (ahead 36 / behind 0). PRODUCTION_APPROVED_PAIRINGS remains empty and ADR 0034 remains Proposed / not implemented-main.
Required surviving contract
A positive Rubin pairing must bind:
- immutable generator/model ID and version;
- canonical Rubin analysis ID/version;
- exact Validation Evidence ID and SHA-256;
- owner-controlled canonical Validation Evidence
AvailableTime;
- owner-controlled immutable Validation Evidence source snapshot;
- design envelope and indicator kind.
The receipt snapshot, runtime snapshot, and owner-approved evidence snapshot must be the same immutable identifier. Branch names, PR aliases, repository URLs, latest aliases, or cross-snapshot reuse fail closed.
Keep this issue open until exact-head hosted checks execute and the surviving Analysis Run vehicle (#416 or verified successor) demonstrably inherits the source/test/ADR/research contract. Do not simple-close on branch-local repair alone.
Finding
Draft #506 correctly requires
RubinProjectionActivationReceiptV1.source_snapshot_idto be immutable and equal to the Analysis Run snapshot. However, the owner-controlledApprovedRubinProjectionPairingpreviously bound generator/analysis/evidence/digest/availability/design/indicator but did not bind the authoritative source snapshot covered by that Validation Evidence.That left a provenance gap in the future positive path: the same approved Validation Evidence ID/digest could be presented in a receipt for another immutable snapshot, and
decide_with_registrywould accept it so long as the caller's receipt snapshot equaled the runtimeexpected_snapshot_id. The registry had no way to say which immutable snapshot the approved evidence package actually validated.The production registry is empty, so this is a pre-promotion repair rather than an active production authorization bypass. It still blocks adding any positive Rubin pairing until the surviving vehicle inherits and verifies the contract.
RED → causal repair
e2e4f4597a1404b272f88d4bcd689816890864f9adds a private-registry regression requiring an approved Validation Evidence package for immutable snapshot A to reject a receipt/runtime for immutable snapshot B. The RED intentionally references the missing owner-side snapshot field.32aa83da55c75ab22ebbca8a903790be119cc20eaddssource_snapshot_idtoApprovedRubinProjectionPairing, validates that owner snapshot as an immutable locator-safe identifier, and requires exact receipt/authority snapshot equality.main) fails closed.c4572953382e50d9c12735a500227ed4c9900a05.85ab06bb948149fd4a93d96f91b75f25f1cbaec4.Current Draft #506 exact head is
85ab06bb948149fd4a93d96f91b75f25f1cbaec4, ordinary forward history on #504 exact parent3d153b382e2382efb532f49bb1e2a8b93be0b73f(ahead 36 / behind 0).PRODUCTION_APPROVED_PAIRINGSremains empty and ADR 0034 remainsProposed / not implemented-main.Required surviving contract
A positive Rubin pairing must bind:
AvailableTime;The receipt snapshot, runtime snapshot, and owner-approved evidence snapshot must be the same immutable identifier. Branch names, PR aliases, repository URLs, latest aliases, or cross-snapshot reuse fail closed.
Keep this issue open until exact-head hosted checks execute and the surviving Analysis Run vehicle (#416 or verified successor) demonstrably inherits the source/test/ADR/research contract. Do not simple-close on branch-local repair alone.