[shiv2123]

datetime.fromisoformat is not version-stable. On Python 3.10 it accepts
fractional seconds only at exactly 3 or 6 digits, so 14:02:00.9Z raises, while
3.11+ accepts it. The unparseable branch returned the string verbatim, so
canonicalization silently did nothing on 3.10.

The consequence is that identical evidence produced different digests on
different interpreters. That breaks the content-addressed cache and would have
made eval corpus entries collected under one interpreter unreproducible under
another.

Timestamps are now parsed with an explicit pattern covering the separator, Z
and z, offsets with and without a colon, optional seconds, and any fractional
precision, then rebuilt into a form every supported interpreter parses
identically.

Caught by CI: 3.12 passed and 3.10 failed. The matrix earned its place on the
first real disagreement.

[github-actions]

Tickmark — evidence collected

Control evaluation is not wired up yet. This is the evidence the engine sees.

Signal	Value
Files changed	2 (+98 / -6)
Production paths touched	1
Test paths touched	1
Commits	1
Approving reviews	0
Checks reported	3 (0 success)
Linked issues	0
Work item references	no pattern configured
Revert	no
All files exempt	no
Branch protection readable	no

Notices

• warn branch_protection_unavailable — Could not read branch protection (HTTP 403). Token likely lacks admin scope. Controls relying on it will report NOT_APPLICABLE.

Provenance

• Evidence digest: sha256:31a518e98e1cdfe34da9d81d764ed5bf00ecbe0bad986f8968d705241a9c19f3
• Head SHA: 8b104a6a40e1c22b1ebc7a59399ae5c8c91a37e1
• PR state: open
• Fork PR: False