Repository navigation
fix(selection-monitoring): bind post-issuance validation and export to one snapshot #273
Description
Finding
Selection Monitoring had two distinct post-issuance integrity gaps in the same canonical-export boundary.
The first was representation-preserving runtime aliasing: after issuance, low-level mutation could replace an exact built-in trust field with a behavior-bearing subtype carrying the same serialized value. That gap was repaired on PR #42 before this update by re-establishing exact built-in runtime types before canonical rendering.
A second checked-versus-used gap remained. At 155c9cdc9586ac29bdc4ace8a718fba3ab6304a5, _assert_canonical_runtime_evidence(plan) read and validated live object fields, then _canonical_plan_json_unchecked(plan) reread those fields for rendering. Another thread could therefore mutate monitoring_start after validation but before .isoformat(), substituting caller-controlled subtype behavior into the export that had just passed the type gate.
Reality RED
Test-only exact a08e12cb246a31f7ec6f9026b3f1fc5bade07930 adds a deterministic barrier after runtime validation, then replaces monitoring_start with an executable date subtype before rendering resumes.
Foundation CI 34355327114, job 102478423049, materialized the real RED on that exact head: the Selection Monitoring package ran 123 tests and finished 1 failed, 122 passed because test_canonical_export_uses_the_same_runtime_snapshot_it_validated observed AssertionError("caller-controlled date method executed"). The RED head still reported 100% owned statement and branch coverage, so this is a behavioral integrity failure rather than an uncovered path.
Causal repair
Exact source repair e5a53ca440ac7ed38049095afdf39bef34591078 introduces one captured canonical runtime-evidence dictionary. Canonical export now:
- reads each serialized trust-bearing field exactly once;
- exact-type validates that captured snapshot;
- renders date/timestamp/JSON exclusively from the same snapshot;
- compares those canonical bytes with the original process-local issuance seal.
A subtype present at capture fails closed before caller-controlled rendering. A mutation after validation cannot alter the already-captured value used by that export. A subsequent export sees the new live value and fails the exact-type boundary. Valid canonical JSON/schema and the public builder contract are unchanged.
Foundation CI 34355550242, job 102479182632, completed SUCCESS on exact e5a53ca440ac7ed38049095afdf39bef34591078, including Foundation dependency hygiene, owned unit/service contracts, isolated PostgreSQL contracts, and read-only validation.
Documentation successor 6749ea11063c091a1aa8af1714af5e088cb4a3db updates ADR 0016, Selection Monitoring traceability, README, and package CHANGELOG so the one-snapshot invariant is code-current. Its exact-head workflows are fresh and must be judged independently; predecessor GREEN does not transfer.
Canonical owner / acceptance
PR #42 remains the sole Selection Monitoring writer, based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Preserve aggregate-only scope, human-only consequential authority, exact 100% statement/branch coverage, privacy/issuance regressions, and current Foundation dependency order. Do not restore a package-local workflow, weaken the seal/type boundary, or copy mutable shared Foundation source.
Keep this issue open until PR #42 is normally integrated to protected develop, or a verified successor demonstrably carries every valid source/test/docs/evidence delta. Central required-workflow failures are repaired at their canonical owners rather than with leaf retries or gate weakening.
Activity
seonghobae commentedon Sep 7, 2026
Test-first owner repair is now on canonical PR #42 without history rewrite.
06d8d2fbf8822f26758b810004dadbcf218c83e0test_post_issuance_runtime_type_integrity.py;strsubtype replaces an issued digest without changing canonical text;datesubtype replaces the issued business date and trips if.isoformat()is reached;c2a157d37f3a0bf6ac04f3ca2101a6607087e8f7isoformat(), canonical timestamp rendering, JSON serialization, or HMAC comparison;Net delta from predecessor
ec35dc87...is 2 forward commits / 0 behind and only the Selection Monitoring production module plus its new regression file. Fresh current-head Foundation34139613554, Security34139613394, SAST34139613429, and CodeQL34139613460are queued at this read. Keep #273 open until current-head owned coverage/hosted evidence is terminal and the #42 dependency/governance path is revalidated.seonghobae commentedon Sep 7, 2026
Documentation/authority synchronization completed by ordinary forward commits after the runtime fix. Current canonical #42 exact head is now
155c9cdc9586ac29bdc4ace8a718fba3ab6304a5on protecteddevelop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.packages/selection-monitoring/README.md, package CHANGELOG, ADR 0016, anddocs/traceability/selection-outcome-monitoring.mdnow state the same two-part integrity contract: (1) exact built-in runtime types must still hold before any canonical field behavior/serialization executes, then (2) the process-local HMAC verifies semantic canonical bytes. TRACEABILITY names the new same-value text/executable-date regression explicitly.Current exact-head runs: Foundation
34140109476, SAST34140109425, Security34140109689, CodeQL34140109611; all were queued at the latest read. Keep #273 open until current-head hosted package/coverage evidence is terminal; #42 itself remains Draft and still depends on #258/#259 protected Foundation ownership before integration.seonghobae commentedon Sep 7, 2026
Current acceptance update for canonical #42 exact
155c9cdc9586ac29bdc4ace8a718fba3ab6304a5: Foundation34140109476and SAST34140109425are terminal SUCCESS, so the representation-preserving runtime-alias repair has current-head executable/static gate evidence. Security34140109689fails only at the shared Dependency Review availability probe (.github#810), and CodeQL34140109611fails only in the central terminal-verdict ordering/publication path (.github#1929): both compatibility readers fail before a later same-run dispatch succeeds. No qualifyingAPPROVEDreview exists.Keep #273 open through normal #42 protected integration or a verified successor carrying the same regressions. Do not reclassify central control-plane failures as a Selection Monitoring source RED, and do not churn the exact source head to retrigger them.
[-]fix(selection-monitoring): reject representation-preserving post-issuance runtime aliases[/-][+]fix(selection-monitoring): bind post-issuance validation and export to one snapshot[/+]