[abrichr]

Problem

Every bundle certified before Anchor.form_identity and TokenTemplate.bearing were added now fails Workflow.load with "governed authorization template cannot be reproduced from the sealed certification". The certification's workflow-contract digest is a plain dump of the workflow. It now writes both new fields as null, so it no longer matches the digest the certification was signed against. The content digest is unaffected, because it already leaves such fields out through the reviewed _SEALED_CANONICAL_OMISSIONS_BY_VERSION list. The certified OpenEMR referral program (ec096afa…, used by #1431 and the lifecycle arm) is one of the bundles this breaks.

Rule

• The current digest is computed first, exactly as before, and wins whenever the persisted qualification is bound to it, or to nothing.
• Otherwise an older form is tried. It reuses the same omission list, more narrowly. A field is left out only when all of these hold:
  • its owner and name are on the list for the bundle's format version;
  • the rule accepts None;
  • its value is None;
  • the loaded file never set it (model_fields_set).
• A field the file wrote, even as null, stays in the digest, and so does any non-null value.
• The older form is used only if it reproduces a bound digest exactly.
• Workflow.load records which form matched (qualification.certified_contract_form).

Tests

tests/test_certification_sealed_omissions.py, with the real OpenEMR bundle copied in as a fixture:

• the pre-field certified bundle loads, and the older form is recorded;
• a non-null bearing is refused, in the file and in memory;
• an explicit null that the sealed file never held is refused;
• a field taken off the list is refused;
• a rule that does not accept None is not used;
• a format version with no rules gets no fallback;
• a bundle bound to the current digest gets no fallback.

The existing qualification, governed-authorization, run-gate and seal suites pass.

[abrichr]

Codex review: APPROVE at 56c0d32. Codex found no path where a changed contract loads as certified. The current digest wins. The historical form needs the exact version, owner and name, a rule that accepts None, a None value, a field the file never set, and an exact bound digest. The other certification checks still apply independently. 309 cases passed on an independent Linux run.

[abrichr]

Reopening to retrigger CI: the last run's packages and smoke jobs were abandoned by the runner, no test failed.

[abrichr]

Codex delta review: APPROVE at 217ffae for the fixture reformat (its AST equals the approved fixture). The main merge reproduces a clean three-way merge.