security: harden trust-bearing principal runtime storage at API authentication boundary

[seonghobae]

Finding

People API and Job Analysis API AuthenticatedPrincipal are tuple subclasses, so direct tuple.__new__(AuthenticatedPrincipal, ...) can bypass the public constructor. The owner contract therefore requires ordinary public principal behavior to revalidate complete trust-bearing raw storage instead of treating construction provenance as authority.

This remains a service-TCB evidence-integrity boundary. It does not claim to constrain arbitrary same-interpreter code that deliberately invokes low-level base primitives; hostile executable code belongs outside the service TCB.

RED → repair chain in #65

Earlier RED/fix pairs established exact UUID/string/frozenset/scope types, subclass sealing, caller-owned UUID detachment, no writable instance slots, strict principal-only equality/inequality, fresh UUID reconstruction, raw tuple-slot revalidation, and guarded index/slice/iteration/list/tuple views.

The #175 refinement is test-first and non-force:

• People RED 5755c4dc5b81b7fc2153922242b637642743f402: malformed exact-class storage must fail through len, membership, count, index, concat/reflected concat, repeat/reflected repeat and rich ordering; structurally valid storage remains tuple-compatible.
• Job Analysis RED 39208dfb108253e21e29bd444dbf44f5da7f8291: mirrors the same contract.
• People fix e7aff6af7c89ba37ce7960e673a5ba8a1df0643e and Job Analysis fix 43821d812089fa4bc3c228a2f759ce7abe849471 revalidate complete stored principal evidence before those public operations.

Those commits remain unchanged ancestors of current #65 head cf14ca8e06f788d905be59f76a987282c1c24395 on protected develop@ef1b143368cb6249c9520ca8cae10ebe844a5aa1; later #176–#178 change durable Job Analysis command/identity boundaries rather than principal implementation.

Acceptance state

Historical CodeRabbit review of 43821d8120... remains causal predecessor evidence only. Current cf14ca8e... has no qualifying exact-head approval or substantive independent review covering the complete tree.

Exact-head Job-Analysis API Quality run 33791230759 has API contract/100%-coverage 100768049957 and PostgreSQL integration 100768050354, both queued before checkout with runner_id=null, steps=[] and protected-tree ubuntu-latest. Hosted GREEN is not claimed. #161 remains the canonical repository-owned explicit-ubuntu-24.04 prerequisite; its workflow delta must not be copied into this owner branch.

Keep #175 open until exact-head hosted evidence, required current-head review and ordinary protected integration complete. Do not copy this repair into #163/#165 or consume mutable #65 source as a released dependency.

[seonghobae]

Fresh #175 repair extension on canonical PR #65 found a representation-level validation gap that remains after subclass sealing and UUID alias detachment: because AuthenticatedPrincipal is a tuple subclass, direct tuple.__new__(AuthenticatedPrincipal, (...)) can create an exact runtime-class instance without invoking AuthenticatedPrincipal.__new__. The prior public properties and tuple-backed equality/hash therefore trusted raw slots solely because the class was exact.

Test-first regressions:

• People RED 1d13d6d3a90c05ad9d924aac0b1219f1cdfaf4c1
• Job Analysis RED 1d2eec5a7ba774c4ebe9081f2b2fdc0827e8d74b

They construct exact-class tuple instances with actor/scope runtime subtypes and malformed arity and require public field access plus value semantics to reject malformed storage. They also preserve a control showing structurally valid tuple storage remains value-compatible; this does not treat Python construction provenance as an unforgeable capability.

Causal fixes:

• People 3fcbe7634d9af359334b2b8ed0a8d384b7fd0e1b
• Job Analysis 7e5fc43806f6fe94a77dfcbd8bffd1bf61ab0439

Both services now revalidate the raw built-in tuple slots on public principal access, repr, exact-principal comparison, hashing, and pickle reconstruction. Tenant storage must be an exact operational integer, actor evidence an exact canonical string, and scopes an exact non-empty frozenset of exact canonical scope strings. This closes malformed storage publication through a base-type constructor while retaining the existing service-TCB boundary: valid-shaped same-process values are data, not cryptographic capabilities.

Canonical #65 current head is 7e5fc43806f6fe94a77dfcbd8bffd1bf61ab0439 on protected base develop@ef1b143368cb6249c9520ca8cae10ebe844a5aa1. A fresh CodeRabbit exact-head review has been requested. Hosted GREEN is not claimed until the new head's People/Job Analysis and required central jobs actually execute.