fix(acquisition): require canonical updated_at identity

[seonghobae]

Purpose

Test-first acquisition evidence-integrity hardening. Buyer-facing updated_at metadata currently trims the supplied JSON string before ISO validation, so whitespace-padded timestamps can be normalized into freshness authority rather than rejected as non-canonical evidence.

RED

• protected base: 2d8a07df19c5e9aa10887b8140d7768de237bea7
• RED head: 38f45505d2b901c1a4c13f7a0c28d8638963d6f6
• production source unchanged on this head
• acceptance: " 2026-08-21T12:00:00Z " must fail with the existing updated_at must be an ISO date or timestamp evidence-integrity contract, while canonical date-only and timezone-bearing timestamps remain valid

Keep Draft until exact-head CI proves the RED and the smallest metadata-boundary repair receives fresh full GREEN evidence.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 81b01e3f-2084-4d33-b1b8-f4f4ad74e34f

📥 Commits

Reviewing files that changed from the base of the PR and between 2d8a07d and f274294.

📒 Files selected for processing (2)

• scripts/acquisition-readiness-audit.mjs
• test/acquisition-evidence-iso-date.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.