security(job-analysis): detach durable snapshot scalars before kernel reconstruction

[seonghobae]

Finding

Canonical #65 at predecessor b2541fda461cedc4508f9ce3f71797307ad4bb42 validated PostgreSQL row containers and fixed projection cardinality, but _load_snapshot(...) still passed most durable scalar values directly into HRIS-kernel constructors before exact runtime detachment. Only snapshot tenant and analysis identities were normalized first.

An exact built-in tuple/list row can still contain executable scalar subclasses. Protected HRIS-kernel Job Analysis validators accept broad protocol families and then perform text normalization, regex, range comparison, UUID equality/hash/set membership, timezone operations and canonical serialization. Driver-returned scalar evidence therefore needed its own trust boundary before any kernel reconstruction.

Repair lineage

• test-first 09b321e657460914113d07df18ececc4591b368f: executable stored content_digest_sha256 must fail closed before equality;
• production 5e6b6312afa381fe376854c5b62df713e6274486: exact built-in lowercase SHA-256 validation before digest comparison;
• test-first 9aee97df40009d07956ab8c70c0e1557ec482fd9: executable persisted job_profile_id must fail before kernel ownership logic;
• test-first breadth 58e0c6ba9aacde7fe706443e2c2f8ad44cea4d2e: executable UUID/text/int/datetime projections must not dispatch comparison, split, range or offset hooks;
• production 42670927d263ebe78ddc363b7ecba5370b0a52fc: exact-validate header, FJA source, Task, KSAO and Task–KSAO link durable scalars before HRIS-kernel constructors;
• compatibility regression 201c67580a4e1e37b628ef0374cdb850b4555cc9: preserve Psycopg 3 timestamptz materialization using standard-library zoneinfo.ZoneInfo rather than over-constraining to datetime.timezone;
• production 79ad46bf4913b6313aba2daa8340cf4678e7400b: accept only exact datetime values backed by exact standard-library datetime.timezone or zoneinfo.ZoneInfo;
• current coverage head 5b49fb13e44a9483ebd411b0495c80039ff96d50: exact built-in datetime carrying a custom executable tzinfo must fail closed before the timezone hook runs.

SQL projections, 3NF schema, RLS, command/idempotency semantics and #205–#207 returned-graph capture semantics remain unchanged. #63/#64/#163/#165 do not receive copied mutable implementation.

Exact current evidence

CodeRabbit independently reviewed exact 5b49fb13e44a9483ebd411b0495c80039ff96d50 against protected develop@ef1b143368cb6249c9520ca8cae10ebe844a5aa1 and found no static issue in #208 scope. It verified static Python parsing, exact row-container gates, exact scalar validation before kernel operations, custom tzinfo fail-closed behavior, datetime.timezone/ZoneInfo compatibility, and no #205–#207 source delta. This is static review evidence only.

Exact-head Job-Analysis API Quality run 33869586087 is still pre-checkout: contract/100%-coverage job 101012145647 and PostgreSQL integration 101012145742 are queued, steps=[], with no assigned runner on the protected-tree ubuntu-latest selector. Hosted RED/GREEN is therefore not claimed.

Keep this issue open through exact-head hosted acceptance and ordinary protected integration.