evidence(longitudinal): bind CWC cutoff admission to owner-issued source snapshot receipts #603

Temporal / Evidence finding

longitudinal_cwc_v1 now has strong internal historical-admission semantics, but the public input boundary still trusts the caller for the facts that make those semantics meaningful.

At #372 exact 47b6a6c85c69983bd843d8bb6d19001cfd3629d8, LongitudinalClusterScore::new accepts caller-provided evidence_id, snapshot_id, predictor/outcome coordinates, and AvailableTime. admit_scores_at_cutoff() correctly removes rows whose supplied availability is after KnowledgeCutoff, then enforces snapshot identity and duplicate-visible-evidence refusal. #600 also commits the exact admitted IDs, coordinate bits, cluster key, and supplied availability into admitted_evidence_sha256.

Those contracts prove replay of the values presented to Analysis. They do not prove that Evidence issued the named source record, that the logical snapshot is bound to immutable source bytes, or that the supplied AvailableTime is the owner-controlled availability clock. A caller that knows a late source row can therefore construct the same numeric row with an earlier AvailableTime and make it eligible for a historical cutoff. The resulting digest faithfully commits the forged clock; hashing the forged value is not provenance or anti-backdating authority.

This is distinct from:

• scientific(analysis): exclude future-only cross-snapshot rows before provenance admission #595, which correctly orders cutoff admission before snapshot/domain checks after a row reaches Analysis;
• validation(longitudinal): bind CWC artifacts to the exact cutoff-visible evidence payload #600, which commits the exact admitted payload but explicitly does not attest its generator/source lineage;
• measurement(longitudinal): bind CWC coordinates to a versioned measurement contract #602, which binds the measurement/scoring meaning of predictor/outcome coordinates through a released Measurement owner contract;
• scientific: establish longitudinal CWC recovery acceptance evidence #501, which owns true-parameter recovery/scientific acceptance.

Canonical owner path already under development

Evidence Draft #527 exact 5c109c201b2f552e7ba573de9fe1512983e4dc6a already owns the correct reusable provenance primitive for the analogous Rubin gap #524:

• SourceArtifact / nominal SourceArtifactId are owner-issued rather than reconstructed from generic wire;
• generic JSON parses only to validated-but-untrusted wire types;
• SourceObservation and SourceAvailability own distinct identities/clocks with AvailableTime >= SystemTime;
• SourceSnapshotReceiptV1 binds owner artifact/observation/availability identities, immutable logical snapshot identity, source SHA-256, SystemTime, and AvailableTime;
• matching syntax/digest does not authenticate caller-selected IDs;
• feat(evidence): own immutable source snapshot receipts #527 remains Draft and is not production authority until its foundation, exact-head gates, review, protected-main landing, and release/compatibility path are satisfied.

Do not fork that receipt logic into analysis_engine and do not treat #527's mutable branch head as an allowed production dependency.

Required RED

Once a protected/released Evidence receipt contract is consumable, add a public #372-or-successor regression with one immutable source snapshot and owner-controlled availability after the historical cutoff. Construct an otherwise matching CWC numeric row whose caller-facing fields claim an earlier availability. The run must fail closed before the row can enter the scientific population.

The companion positive case must use the exact owner-issued receipt whose authoritative AvailableTime <= KnowledgeCutoff and prove that:

1. receipt source snapshot identity matches the Analysis snapshot;
2. receipt availability, not a caller alias, determines historical eligibility;
3. the execution artifact/terminal lineage preserves an opaque digest/reference to that exact owner receipt or an equivalent immutable binding;
4. same logical snapshot_id with a different source-content digest/receipt cannot silently reuse the prior CWC artifact identity;
5. future-only receipts do not leak their existence into the earlier artifact/result.

A realistic RED should exercise the public Analysis/Evidence ACL, not private field mutation, a magic evidence-id prefix, or a test-only trusted timestamp.

Minimal causal repair boundary

• Consume an owner-issued, immutable Evidence receipt before numeric admission through a typed ACL.
• Make the authoritative receipt AvailableTime the cutoff clock; never accept a second caller-controlled availability value as equivalent authority.
• Bind source snapshot identity/content provenance to the admitted numeric evidence without copying source bytes or querying Evidence tables directly.
• Preserve scientific(analysis): exclude future-only cross-snapshot rows before provenance admission #595 cutoff-before-domain behavior: a future-only receipt must be excluded before historical duplicate/snapshot scientific census where the owner contract says it was unavailable.
• Preserve validation(longitudinal): bind CWC artifacts to the exact cutoff-visible evidence payload #600 content commitment, but keep admitted_evidence_sha256 distinct from source-lineage attestation.
• Preserve measurement(longitudinal): bind CWC coordinates to a versioned measurement contract #602's separate predictor/outcome Measurement authority. Evidence provenance answers which immutable source/when; Measurement provenance answers which versioned construct/scoring definition.
• If the receipt changes the CWC wire/artifact schema, version the contract explicitly rather than adding an unverifiable compatibility field.

Acceptance

Keep this issue open until the surviving Analysis Run authority has:

• protected/released Evidence owner prerequisite from feat(evidence): own immutable source snapshot receipts #527 (or a verified successor with complete inheritance);
• public backdating/source-digest RED;
• causal ACL repair before numerical admission;
• digest-bound execution provenance that distinguishes source-lineage drift from numeric-evidence drift and measurement-contract drift;
• leakage-safe rolling-cutoff tests including future-only source receipts;
• ADR/TRACEABILITY/product-gap decision evidence;
• exact-head Rust/rustdoc/owned line+branch+edge/security evidence and qualifying independent review.

This issue does not authorize source copy, cross-service SQL, caller-selected owner IDs, mutable PR-head dependencies, hash-as-authentication, inferred availability from numeric content, skip/xfail, denominator manipulation, force push, destructive rebase, or predecessor-GREEN transfer.