[MaxGhenis]

Require audited evidence for a UK regional release served on an accepted model mismatch.

This branch stacks #704 (da2ae8fb) into #699 (afee349d2) with a merge commit. The intended release order remains main → #704 → #699 → certification.

Invariants:

• National certification never widens. The national dataset name/hash, model coverage and core checks remain separate from the regional exception.
• An accepted area mismatch requires a reviewer reason and audited evidence bound to the exact dense cut URI, original manifest bytes, artifact identity/SHA-256, and exact target model package/version. Certification recomputes the comparison and refuses every dropped column. There is no dropped-column override.
• Every defaulted input is recorded across every stored period, accounting for the country loader's input aliases. Free-text limitations and the dense cut's pre-fix VAT limitation survive Pydantic validation and are hashed with the bundle.
• TRACE and execution receipts expose the full regional identity, acceptance, reason, input audit and limitations. TRACE preserves the record as a JSON-LD JSON literal; area receipts remain uncertified and identify their actual build model.
• Re-certifying with --drop-regional-release removes the exception, regional manifest digest, area routes and dense artifact without changing the national certificate.

The comparison is ported from Microcosm #1348's tools/certify_uk_cut_in_policyengine_py.py and strengthened to inspect byte-verified H5 entity-table columns by period. scripts/audit_regional_input_surface.py produces the required JSON; certify-data --regional-input-surface-evidence consumes it with the accepted reason. The original regional manifest's raw-byte digest is retained.

Budget route: national microcosm-uk-2024-25-national-20261023T075039Z-a133f37a (2.147.2) and dense microcosm-uk-2024-25-dense-20261019T000432Z-ee5c2dbe (built on 2.132.6). The exact model-inventory comparison yields 16 added pure inputs, including salary_sacrifice_returned_to_income and local_bus_uncapped_single_fare; the complete list is documented. Actual dense-byte evidence must be generated by certification with authenticated access to the H5. This implementation job has no HF credential and does not certify that pair.

Required downstream refresh: update the dashboard's vendored tests/fixtures/w4/execution_receipt.v1.schema.json from this repository's regenerated schema.

Validation: 1,248 selected cases passed and two skipped across the UK run and three successful US metadata reruns. One unrelated US offline-import integration case was explicitly deselected. Formatting, lint, generated-schema equality and bundle checks pass. Mypy retains the same 24 baseline diagnostics, with zero errors in the new modules. Expanded validation was interrupted after 3,008 reported passes and five skips; it is not claimed complete. Details are recorded in .job/HANDOFF.md. Regression tests demonstrated failures before implementation. Leave this PR draft.

🤖 Generated with Claude Code