Root identity: every raw microdata input hash-pinned and referenced to its Chronicle registration

Consumer side of the Chronicle raw-microdata identity ADR (PolicyEngine/chronicle docs/adr-chronicle-raw-microdata-identity.md, PR and implementation issue opened today in that repo): every raw microdata input Microcosm builds from should resolve to one witnessed Chronicle registration, by hash, and the build should fail closed when local bytes differ.

Current state (verified 2026-09-02 on origin/main d2b31496)

Pins that do exist live in four places: these manifests, the ASEC raw-stage checkpoint metadata (us_runtime/asec_checkpoint.py validates per-source sha256/member_sha256), code constants (us_runtime/weeks_unemployed.py), and tools/build_us_multispine_pool.py --*-sha256 arguments. No shared registry, no licence record, no witnessed fetch time.

Proposal

1. Every *_microdata artifact entry in a country source_stages.json carries sha256 and a chronicle_artifact reference (source_id, package_id, year, sha256, and the R2 key when bytes exist). The raw-only doctrine (microcosm#530, #665 scope ruling) already requires pinning the raw licensed asset; this makes the pin a shared, witnessed one.
2. source_manifest.py validates the new fields; the source runtime records the resolved registrations in the build manifest / Logbook next to the Chronicle consumer-artifact pin it already records.
3. A fail-closed gate: local bytes (or the checkpoint's recorded per-source hashes) must equal the registered sha256; mismatch stops the build with the publisher, vintage, and both hashes in the message.
4. Licensed and restricted files (FRS, SPI, BE-SILC, IRS PUF) reference hash-only registrations. Bytes stay where they are today (licensed environments, private HF repos); nothing about data access changes.
5. New countries land registered from day one (Armenia #814 is the first test).

Acceptance

• Zero *_microdata entries without sha256 + chronicle_artifact across all country manifests; a contract test enforces it.
• Build manifests list every root registration; the gate has a test for the mismatch path.
• No on-disk or artifact key renames (frozen at v1 per #639); no change to HF destinations.

Related: #530, #665 (workstream E), #204, #814, #836 (node identity), chronicle#143 (bucket name migrating; reference whichever bucket is current).

Start with source_manifest.py and the country source_stages.json manifests, then read the ASEC checkpoint validation in us_runtime/asec_checkpoint.py and the build_us_multispine_pool.py hash arguments. Trace how the source runtime records build-manifest and Logbook data. Done means every *_microdata entry has the required pin and Chronicle reference, contract coverage exists, and the hash-mismatch gate test passes without renaming artifacts or changing HF destinations.