fix(selection-monitoring): reject representation-preserving post-issuance runtime aliases

[seonghobae]

Finding

Canonical Selection Outcome Monitoring evidence is issuance-sealed by HMAC over canonical JSON, but the current export path treats equality of serialized bytes as sufficient post-issuance runtime integrity.

At exact owner head ec35dc87d6be4f44a2c7b44311fa8c89bb080fb3, construction correctly rejects caller-defined str subclasses. After issuance, however, object.__setattr__ can replace an exact built-in text field with a behavior-bearing str subclass carrying the same underlying text. _canonical_plan_json_unchecked(...) serializes that subclass to the same JSON bytes, so the HMAC comparison can still succeed. The live packet therefore retains executable caller-owned runtime state even though the canonical bytes are unchanged. The same class of representation-preserving alias applies to exact date evidence if a post-issuance subclass can reach .isoformat() before an exact-type gate.

This is distinct from the already-covered value-changing tamper case: changing population_snapshot_digest from a…a to f…f changes bytes and is rejected today. The missing regression is same canonical value, different executable runtime type.

Canonical owner / constraints

PR #42 (feat/selection-outcome-monitoring-plan) is the existing Selection Monitoring writer and is already based on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Repair there; do not create a second package owner.

Preserve aggregate-only scope, protected-attribute/small-sample/statistical-plan provenance, human-only consequential authority, exact 100% statement/branch coverage, current #258/#259 Foundation dependency order, and all existing privacy/issuance regressions. Do not weaken the process-local seal or accept mutable/subclass evidence merely because canonical bytes are unchanged.

Test-first acceptance

1. Add an immutable RED regression that issues a valid plan, replaces at least one trust-bearing exact string with a str subclass carrying identical text, and proves current canonical_json() incorrectly succeeds before repair.
2. The repaired canonical export must fail closed on representation-preserving runtime aliases before invoking caller-controlled methods/comparisons.
3. Cover exact-string trust fields and exact date/UTC datetime/integer/boolean runtime types consumed by canonical export; valid issued plans must preserve byte-for-byte canonical JSON and SHA-256 behavior.
4. Keep serialization output/schema and public builder contract unchanged for valid inputs.
5. Obtain exact-head Foundation/Selection Monitoring coverage/security/review evidence on the successor; predecessor checks do not transfer.

This is a runtime-integrity repair, not a statistical-method or employment-decision authority expansion.

[seonghobae]

Test-first owner repair is now on canonical PR #42 without history rewrite.

• test-only RED contract: 06d8d2fbf8822f26758b810004dadbcf218c83e0
  • adds test_post_issuance_runtime_type_integrity.py;
  • same-value str subtype replaces an issued digest without changing canonical text;
  • executable date subtype replaces the issued business date and trips if .isoformat() is reached;
  • no hosted terminal RED is claimed: the short-lived test-only head had no materialized workflow run before the successor.
• minimal production successor/current feat: add governed selection outcome monitoring plan #42 head: c2a157d37f3a0bf6ac04f3ca2101a6607087e8f7
  • adds a canonical-export runtime evidence gate for every serialized trust-bearing text field and the exact date/datetime/int/bool field classes;
  • the gate executes before isoformat(), canonical timestamp rendering, JSON serialization, or HMAC comparison;
  • HMAC remains the semantic-byte tamper check; the new gate closes only its representation-preserving runtime-type blind spot;
  • valid public builder/schema/aggregate-only semantics are unchanged.

Net delta from predecessor ec35dc87... is 2 forward commits / 0 behind and only the Selection Monitoring production module plus its new regression file. Fresh current-head Foundation 34139613554, Security 34139613394, SAST 34139613429, and CodeQL 34139613460 are queued at this read. Keep #273 open until current-head owned coverage/hosted evidence is terminal and the #42 dependency/governance path is revalidated.

[seonghobae]

Documentation/authority synchronization completed by ordinary forward commits after the runtime fix. Current canonical #42 exact head is now 155c9cdc9586ac29bdc4ace8a718fba3ab6304a5 on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.

packages/selection-monitoring/README.md, package CHANGELOG, ADR 0016, and docs/traceability/selection-outcome-monitoring.md now state the same two-part integrity contract: (1) exact built-in runtime types must still hold before any canonical field behavior/serialization executes, then (2) the process-local HMAC verifies semantic canonical bytes. TRACEABILITY names the new same-value text/executable-date regression explicitly.

Current exact-head runs: Foundation 34140109476, SAST 34140109425, Security 34140109689, CodeQL 34140109611; all were queued at the latest read. Keep #273 open until current-head hosted package/coverage evidence is terminal; #42 itself remains Draft and still depends on #258/#259 protected Foundation ownership before integration.

[seonghobae]

Current acceptance update for canonical #42 exact 155c9cdc9586ac29bdc4ace8a718fba3ab6304a5: Foundation 34140109476 and SAST 34140109425 are terminal SUCCESS, so the representation-preserving runtime-alias repair has current-head executable/static gate evidence. Security 34140109689 fails only at the shared Dependency Review availability probe (.github#810), and CodeQL 34140109611 fails only in the central terminal-verdict ordering/publication path (.github#1929): both compatibility readers fail before a later same-run dispatch succeeds. No qualifying APPROVED review exists.

Keep #273 open through normal #42 protected integration or a verified successor carrying the same regressions. Do not reclassify central control-plane failures as a Selection Monitoring source RED, and do not churn the exact source head to retrigger them.