When creating an Archival Object via the API, it is possible to create an AO with a different Repository than the AO's parent Resource. There's no validation that checks that the AO belongs to the same Repository as the Resource, so the result is an orphaned AO that's visible, but inaccessible, via the SUI.

Sample available on the Sandbox (2019-06-26):
http://sandbox.archivesspace.org/resources/9#tree::resource_9

To replicate:

• Create two Repositories (e.g. 2 and 3)

• Create a Resource where repository = 2

• Create an Archival Object via the API via the /repositories/3/archival_objects endpoint, where its ['resource']['ref'] points to the Resource in Repository 2

Expected behavior:
ASpace will throw an error due to repository mismatch between the AO and its parent

Actual behavior:
The AO will successfully be created and have the Resource (repository=2) as its root record, but its repository will still be 3