validation: make Rubin executor the canonical draw-payload digest owner #516

Finding

#515 adds a per-run complete_data_draws_sha256 commitment to the public activation receipt and requires the runtime digest independently. That prevents payload substitution if both values come from the canonical execution payload. The current executor, however, does not yet compute or emit that digest itself; a caller can still invent the hash input representation.

A content digest has scientific/audit value only when its serialization and filtering semantics are owned by the same application boundary that admits the rows used by the Rubin computation. Otherwise two consumers can hash the same numerical matrix differently, or a caller can hash pre-cutoff/pre-transposition bytes that do not match the values actually passed to psychometric_core.

Required repair

Make analysis_engine the canonical owner of the concrete complete-data draw-payload digest after cutoff/snapshot admission and before numerical combination.

Use a versioned, domain-separated deterministic binary representation rather than locale/JSON formatting:

• digest only the admitted complete-data indicator draw matrix actually passed to psychometric_core;
• preserve exact draw order and admitted observation order;
• bind observation count and draw count;
• encode finite f64 values by stable IEEE-754 bit pattern in fixed byte order;
• late rows excluded by AvailableTime > KnowledgeCutoff must not alter the historical digest;
• changing any admitted draw value must change the digest;
• carry the resulting canonical lowercase SHA-256 in the digest-bound Rubin artifact with a read-only accessor and canonical-format validation;
• future activation should consume this executor-produced artifact digest rather than rely on an ad hoc caller serialization.

Do not infer approved-generator execution from this digest. It is canonical payload identity, not generator attestation. Do not copy Rubin arithmetic out of psychometric_core.

RED target

For identical snapshot/cutoff and eligible draws, adding only a future-unavailable row must preserve complete_data_draws_sha256. Changing one eligible draw value while preserving snapshot, row count, draw count, indicator kind, and cutoff must change it. Artifact import must reject malformed/noncanonical digest values.

Lifecycle

Implement on Draft #506 as an ordinary forward repair, keep ADR 0034 Proposed, keep production activation registry empty, and hand the complete source/test/docs delta to #416/#435. Do not close until exact-head hosted evidence and surviving-vehicle inheritance are verified.