Root identity: every raw microdata input hash-pinned and referenced to its Chronicle registration

[MaxGhenis]

Consumer side of the Chronicle raw-microdata identity ADR (PolicyEngine/chronicle docs/adr-chronicle-raw-microdata-identity.md, PR and implementation issue opened today in that repo): every raw microdata input Microcosm builds from should resolve to one witnessed Chronicle registration, by hash, and the build should fail closed when local bytes differ.

Current state (verified 2026-09-02 on origin/main d2b3149)

Manifest	Kind	Entries	With sha256	Chronicle reference
us/source_stages.json	public_microdata	37	8	none
us/source_stages.json	versioned_derived_microdata	2	1	none
uk/source_stages.json	licensed_microdata	19	19	none
uk/source_stages.json, uk/hmrc_income_source_stages.json	private_microdata	2	2	none
be/source_stages.json	restricted_microdata	1	0	none

Pins that do exist live in four places: these manifests, the ASEC raw-stage checkpoint metadata (us_runtime/asec_checkpoint.py validates per-source sha256/member_sha256), code constants (us_runtime/weeks_unemployed.py), and tools/build_us_multispine_pool.py --*-sha256 arguments. No shared registry, no licence record, no witnessed fetch time.

Proposal

1. Every *_microdata artifact entry in a country source_stages.json carries sha256 and a chronicle_artifact reference (source_id, package_id, year, sha256, and the R2 key when bytes exist). The raw-only doctrine (microcosm#530, UK dataset build: full migration from policyengine-uk-data (master epic) #665 scope ruling) already requires pinning the raw licensed asset; this makes the pin a shared, witnessed one.
2. source_manifest.py validates the new fields; the source runtime records the resolved registrations in the build manifest / Logbook next to the Chronicle consumer-artifact pin it already records.
3. A fail-closed gate: local bytes (or the checkpoint's recorded per-source hashes) must equal the registered sha256; mismatch stops the build with the publisher, vintage, and both hashes in the message.
4. Licensed and restricted files (FRS, SPI, BE-SILC, IRS PUF) reference hash-only registrations. Bytes stay where they are today (licensed environments, private HF repos); nothing about data access changes.
5. New countries land registered from day one (Armenia EPIC: populace-am — Armenia: closing the EG DNA macro–micro gap on public data #814 is the first test).

Acceptance

• Zero *_microdata entries without sha256 + chronicle_artifact across all country manifests; a contract test enforces it.
• Build manifests list every root registration; the gate has a test for the mismatch path.
• No on-disk or artifact key renames (frozen at v1 per Rename rollout tracker: surfaces still on populace names (frozen v1 + external consumers) #639); no change to HF destinations.

Related: #530, #665 (workstream E), #204, #814, #836 (node identity), chronicle#143 (bucket name migrating; reference whichever bucket is current).

[MaxGhenis]

Chronicle side: ADR PR PolicyEngine/chronicle#222 and implementation issue PolicyEngine/chronicle#221.

[MaxGhenis]

Correction to the state table above: it was computed from a clone whose working tree was ~770 commits behind origin/main (FRS 2023-24 era). Current numbers are in PR #853's body: 32 microdata entries resolve to 21 distinct Chronicle registrations (UK fully pinned against FRS 2024-25, UKDS SN 9563), with 39 roots listed in the ratcheted pending allowlist (37 US, 1 AM, 1 BE).