fix(organization): seal post-issuance export representation and snapshot consistency #279

Finding

OrganizationHierarchyChangeReviewPacket has two distinct post-issuance/export integrity requirements.

1. frozen=True does not prevent low-level object.__setattr__; a trust-bearing primitive can be replaced with a caller-defined subtype whose canonical value is unchanged.
2. The first export-time repair validated live fields and then reread them while constructing the canonical payload, so a concurrent mutation could make the checked and emitted observations differ.

Issuance semantic validation → creation sealing is #280. Same-object issuance lifecycle is #281. recorded_at authoritative clock provenance is #282/#119. Module-level registry exposure is #283.

Canonical owner and RED → repair

PR #96 remains the Organization hierarchy-change review single-writer. Do not copy mutable implementation into another branch. Durable uniqueness, authorization, same-tenant bitemporal resolution, mutation and immutable audit/outbox remain authoritative HRIS responsibilities.

• representation-preserving substitution RED f952154921c43d323085aa34d88eae36f0846220
• first runtime-type repair 204695c7c32f5bc209fda4fb0afebde5df2c504e
• ADR/TRACEABILITY/README/CHANGELOG alignment 9791f1b2f0455b75e3852e006d096338f5bfa987
• Code Quality cleanup b91790e1f376d1daf083c91c7b8e38756be01f84
• concurrent export checked-versus-used regression c8266fd9e98324ff54f25406567aeb1442f8333b
• causal one-snapshot export repair a98066f95ed43dbca722976619dd9603b60c6a2f
• export-contract docs alignment f0caa7fb32d722fff23180bb3bd713fca15a4dc6
• fix(organization): bind issuance validation and seal to one snapshot #280/fix(organization): prevent hierarchy review packet reissuance #281/fix(organization): attest hierarchy-review recorded_at provenance #282 repairs remain on the same ordinary-forward owner lane
• fix(organization): hide hierarchy-review issuance registry mutation capability #283 later removes ordinary module-level mutation capability over process-local issuance state without changing fix(organization): seal post-issuance export representation and snapshot consistency #279's one-snapshot export contract

The export repair captures each trust-bearing field once, validates exact built-in runtime types on that local snapshot, and serializes only those captured values. Pre-capture representation substitution fails closed; post-capture mutation cannot change the selected export; later export still detects semantic mutation against issuance evidence.

Root release-truth contract preserved

The canonical #96 descendant also carries the root CHANGELOG contract for the active Organization hierarchy-review package. That release-truth repair remains part of the valid owner delta and must not be lost by a successor; it does not grant mutation authority or convert branch-local work into a published release.

Current exact-head acceptance — 2026-09-10

#96 is exact 0262d70eaac37e2ab4096c67894a0bae71a4b1d2, directly based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f, open · Draft · mechanically mergeable.

Leaf/source evidence is exact-head GREEN: Foundation 34369393258 / job 102526382630, SAST 34369393198, Required OpenCode job 102527871752, and Required Noema job 102527471651 are SUCCESS. Fresh reviews remain COMMENTED-only with no qualifying independent APPROVED; every visible inline thread is resolved.

Required central/runtime lanes remain non-passing or nonterminal and are not attributed to #279 source:

• Security 34369393189 fails closed at dependency-review job 102526931585 before the pinned Dependency Review action; canonical owner .github#810, exact-head canary 5604514013.
• CodeQL 34369393184 fails because Actions consumer 102526616445 and Python consumer 102526617050 terminalize before authoritative dispatch job 102528422966 starts and succeeds; canonical proposed repair .github#2040, exact-head canary 5604510396.
• Strix 34369390074 / job 102527232339 remains genuinely IN PROGRESS in Run Strix (quick) after successful admission/materialization/CO-sidecar/install/orchestrator/free input preparation. No elapsed-time, provider, or vulnerability verdict is inferred.

No predecessor verdict transfer, unchanged-head retrigger churn, leaf workflow shim, synthetic verdict, self-approval or administrator bypass is permitted.

Acceptance

Keep this issue open until #96 or a verified successor carrying the complete #279 tests/source/ADR/TRACEABILITY/README/package/root-CHANGELOG contract integrates normally into protected develop, with exact-head owned coverage and all then-live required central gates/review governance satisfied. #280/#281/#282/#283 retain separate acceptance boundaries.