feat(membership): add owner-issued single-membership admission

[seonghobae]

Scope

Canonical Membership owner vehicle for #604 and the longitudinal/release prerequisites consumed by #638/#639. This PR owns Membership-domain admission, longitudinal design classification, provenance, privacy-reduced reconstruction coordinates, reachable-state wire validation, and serialization. Reusable one-way ICC arithmetic remains a fast-mlsirm responsibility.

Protected base: main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0.
Current exact head: f5670df0ca2cd1ef7626a939aa61ecef89852721.
Base→head: ordinary-forward, ahead 101 / behind 0, merge base = protected main. No force update or destructive rebase was used.

Membership owner lineage

The branch retains #604 and #606–#613 admission/weight/leave-reentry/design work, then ordinary-forwards the longitudinal release boundary through:

• scientific(membership): classify longitudinal observation support without atomistic collapse #640 longitudinal observation-support classification: RED e84e38bcac0bde0aee90f6ec9f74158de8929fc5 → classifier faed96e783fafdbc8e0565cb1075c0dca72a98d4 → export/coverage/research doctoring through 708642e55b1f021a3201b9de7f684e06750c108f;
• scientific(membership): own stable wire vocabulary for longitudinal design #641 stable six-state wire vocabulary through 3b27cba84f5ceebf0c39c87b9287958656e3a8f1;
• scientific(membership): bind design vocabulary version and owner name as one typed wire coordinate #642 atomic version+name MembershipDesignWire through ccecb461805310ee45e7ca8680d2b1751294e595;
• scientific(membership): prevent caller-issued design coordinates at the owner boundary #643 canonical owner-issued path through 8d2f8367221cb7bb653c8a0c2d71857f8572885d;
• scientific(membership): distinguish parsed wire coordinates from owner-derived classification authority #644 parsed-wire/owner-authority type separation through aef1fa24b2af8fee1b75a9af3bad7720334a2605;
• scientific(membership): bind owner classification to its longitudinal event-time support #645 owner-derived support count/earliest/latest through fa8ffdf77c1f0cf404d06d46bfa45037854122b7;
• scientific(membership): bind canonical observation-support identity to owner classification #646 exact versioned opaque support/topology SHA-256 through 539c5ee7b7f85e22dce4c6f7d2ba0a9222318925;
• scientific(membership): publish privacy-reduced reconstructable longitudinal support wire #649 privacy-reduced reconstructable tepp.membership_observation_support_projection.v1, canonical ordering/parser hardening and topology/design consistency through e425c7034da3f505c8dff49fc19d3ffe80adf40d;
• scientific(membership): issue downstream observation-to-local-support coordinates #650 owner-issued non-wire MembershipObservationSupportCoordinate mapping through 2eca15330e52e585ed4044fc152b88fac29ca2ec;
• scientific(membership): reject support wire states impossible under canonical membership admission #651 reachable-state parsing: exact share-budget reuse and duplicate edge/share-overrun refusal through 3177e98c40135368f81644bf5354baaf80216a46;
• scientific(membership): bind serialized support evidence to a recomputable wire digest #652 recomputable tepp.membership_observation_support_projection_digest.v1: RED 028a0660eeea76c6ce0c16ecfd7b179accb99a9d → causal repair 4e5b64e663868d63a77d9dbed2baedd7cae27621 → deterministic/detached-coordinate coverage and CHANGELOG through 32871b52e801bd501d3ff1f4fee8cd12f17530b3;
• scientific(membership): reject contradictory duplicate observation topology in support wire #653 duplicate-coordinate reachable-state determinism: source RED 0bee645841bc9bb5029e4d82ec0083663d291395 constructs a byte-canonical, digest-consistent payload where one local (member_ordinal, EventTime) appears twice with different individually valid topology. Causal repair 8cd8a6db62c5ce75a56cd342302bb3c9466704e4 remembers the first ordered assignment slice per canonical coordinate and rejects only contradictory repeats; identical duplicate observations remain valid and multiplicity-sensitive under existing owner projection coverage. CHANGELOG ef50885bc21e7e1247a22e4ce1e1c59d8efbd331; source-newline repair/current head f5670df0ca2cd1ef7626a939aa61ecef89852721.

No hosted failing RED is claimed for #653; repair followed the source-level contract before a runner executed the RED head.

Current owner contract

classify_membership_observations resolves every opaque (MemberId, EventTime) coordinate at that observation's own event time and fails closed on missing context. classify_membership_observations_wire issues MembershipDesignClassification only after canonical classification and retains support cardinality, event-time bounds, versioned tepp.membership_observation_support.v1 opaque-support identity, and the six-state Membership design vocabulary.

project_membership_observations_wire issues tepp.membership_observation_support_projection.v1: projection-local member/group ordinals, canonical UTC event times, stable role names, exact lowercase binary64 weight bits, owner design coordinates, the source-support digest, a separate recomputable wire digest, and a parallel caller-order input_coordinates() mapping. Raw MemberId/GroupId UUID text is omitted from the released projection.

The source support_sha256 fingerprints opaque owner identity/topology and intentionally cannot be recomputed after UUID redaction. The wire digest covers the privacy-reduced serialized coordinates and is recomputed by the parser. Neither digest is authentication, and parsed wire remains non-authoritative.

Parsed bytes fail closed for unsupported/unknown fields, noncanonical event-time spelling/JSON/order, malformed weight bits, invalid ordinal spaces, design/topology mismatch, duplicate role/group edges, exact same-role share overruns, detached wire/source-digest coordinates, and now contradictory topology for repeated local member/event-time observations. Byte-identical repeats remain valid so declared observation multiplicity is not collapsed.

Boundary to #638/#639

#639 must not choose a synthetic global as_of, copy Membership source, invent design/group/ordinal mappings, treat parsed wire as owner authority, reproduce Membership digest/classification logic, or treat the recomputable wire digest as authentication. Until #605 lands normally on protected main, #639 may carry only an owner-path dependency note.

After landing, Analysis can zip its own document/evidence IDs with owner-issued input_coordinates() and bind the canonical support wire into its versioned temporal-analysis result, then add mismatch fixtures. Membership owns observation-specific grouping/time/multiple-membership reconstruction; Analysis retains run/window/cohort/document semantics and must not infer HR/person truth from local ordinals.

Numerical owner boundary

membership_core::icc::anova_nested_icc remains duplicated reusable numerical arithmetic and is not final owner truth. Canonical one-way random-intercept arithmetic remains fast-mlsirm #2047. TEPP must not copy its mutable branch. The required sequence remains fast-mlsirm exact-head GREEN + independent approval → protected merge → immutable package release with version/CHANGELOG/SBOM/provenance/reproducibility → TEPP versioned ACL → duplicated arithmetic removal while Membership admission still fails closed before the numerical call.

Current exact-head gate

Exact head f5670df0ca2cd1ef7626a939aa61ecef89852721 has fresh non-terminal runs: Rust Foundation 35649251391, Security 35649251311, Semgrep 35649251344, CodeQL PR 35649251192, Documentation 35649251380; all were queued at the current sweep. No predecessor receipt is accepted. No qualifying independent exact-head approval exists.

Shared-foundation repair #648/#647 remains separate. #605 must not work around protected-main gate defects; after its normal landing, this branch must reconcile/rerun on repaired protected main as needed.

Acceptance

• exact-head Rust/rustdoc/tests/owned line+branch+edge coverage/security/CodeQL/Semgrep GREEN;
• qualifying independent current-head approval;
• observation-specific event time and missing-context refusal preserved;
• six design states retain owner-issued versioned wire names and distinct parsed-wire vs owner-authority types;
• owner classification retains support count/bounds and exact versioned opaque-support/topology identity;
• support wire reconstructs temporal/grouping/multiple-membership structure with local ordinals, exact weights, deterministic ordering and duplicate multiplicity without raw UUID text;
• repeated identical observation coordinates remain multiplicity-sensitive but cannot carry contradictory topology;
• parsed support bytes fail closed for topology/design mismatch and states unreachable through canonical Membership admission;
• source opaque-support identity and privacy-reduced reconstruction remain distinct; wire-content digest stays deterministic/recomputable without being treated as authentication;
• release(contract): publish immutable temporal-analysis contract for Orgmetra consumers #638/fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639 consume only after protected-main landing and add consumer mismatch fixtures;
• fast-mlsirm one-way ICC lands and is released immutably before TEPP replaces duplicated arithmetic through a versioned ACL;
• scientific: establish longitudinal CWC recovery acceptance evidence #501 recovery is reacquired after the relevant Analysis ACL is implemented.

#604, #606, #607, #608, #609, #610, #611, #612, #613, #640, #641, #642, #643, #644, #645, #646, #649, #650, #651, #652, and #653 remain open until downstream/release acceptance is actually satisfied.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh foundation handoff for the Membership owner lane: #648 exact 0be133ae0e0a58c1a0f88a8c59df839eae971ead has validated the central-admission contract repair through repository/Python, authored coverage, PostgreSQL, rustfmt/Clippy, 1,443 tests with 0 skipped, doctests, and rustdoc. Its sole Rust Foundation failure is cargo deny on RUSTSEC-2026-0285 / GHSA-2mjx-qc3c-rqvc from protected-main rustls 0.23.43; canonical remediation is already owned by #526 and inherited by main-target successor #538 exact f335624cea977fea7d7fe6f36871868557fe2bb7 (rustls = 0.23.45, Rust Foundation GREEN).

Do not copy that dependency repair into Membership. A base-only #648→#538 stack was tested without force and proved non-mergeable because both lanes edit the hourly runbook/quality contract, so #648 was restored to main and remains Draft pending #538 normal landing and ordinary-forward reconciliation. #605 exact f5670df0... remains unchanged and its own required runs are still queued; no foundation receipt is transferred to this head.