security(job-analysis): exact-gate durable audit scalar/time evidence before canonicalization

[seonghobae]

Finding

Canonical root ownership is shared HRIS-kernel PR #63, not the Job Analysis consumer. #63 already detaches AuditOutboxEvent.occurred_at to built-in UTC at construction and revalidates runtime evidence during to_cloudevent(), but exact current predecessor b9296614bd687b15a9fa1580099c5e797af52515 built and compared current_snapshot with the creation snapshot before calling _canonical_timestamp(occurred_at).

A same-process caller can low-level rewrite a frozen exact AuditOutboxEvent with object.__setattr__() so occurred_at is still an exact built-in datetime but carries caller-defined tzinfo. Datetime equality during snapshot comparison can invoke that timezone before the canonical exact-UTC gate, so executable provider behavior can run before the shared owner fails closed.

#65 remains the downstream durable consumer and must not copy mutable #63 source. Its acceptance tests should become GREEN only after #63 integrates normally into protected develop and #65 non-force adopts that protected truth.

Test-first / repair lineage

• fix(authz): protect purpose-bound runtime integrity #65 downstream RED seed 200cc2a42e005bb2bcf131f64d60553fbc3c46d0 added durable-consumer tripwires.
• fix(core): protect canonical evidence runtime types #63 canonical RED f1447a86bf4518d43030a02fd24a693dee1ee64a strengthens test_audit_event_canonicalization_rejects_reintroduced_timezone_behavior: a tripwire timezone must not receive even one callback.
• fix(core): protect canonical evidence runtime types #63 minimal production fix 6f26acdbb19cb8de0457645af88eda746f90bddc moves _canonical_timestamp(occurred_at) immediately after runtime snapshot validation and before tuple/datetime comparison. Net production delta is one line moved.
• Manifest reseal ac31f28d6c5c5f13792dead670c962a166e52e1d exposed an unrelated migration-hash transcription error; it was not hidden or force-rewritten. Ordinary successors 38c3fde3d42cc9c141fa15fdc74779c0e32addfa and 5d7eef3595531232c5ba49009445a734fe1945c2 repair the accidental entries. Net b9296614… → 5d7eef35… touches only manifest.json (the intended audit.py digest), audit.py, and the focused runtime-integrity test.
• fix(authz): protect purpose-bound runtime integrity #65 successor 47059d82011973855d7a540788500533859cc96a aligns downstream expectations with the shared-kernel public fail-closed contract (ValueError) instead of inventing a consumer-only normalization contract.

Current acceptance state

#63 exact head 5d7eef3595531232c5ba49009445a734fe1945c2 is open · Draft · mechanically mergeable over protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Exact-head Foundation CI run 33888360718, job 101073647459, is still queued before checkout with steps=[], labels:["ubuntu-24.04"], runner_id=0; CodeQL PR 33888360819, Security 33888360830, and SAST 33888361014 are also queued. Hosted GREEN is therefore not claimed.

#65 exact head 47059d82011973855d7a540788500533859cc96a is intentionally test-only downstream evidence pending #63 protected integration. Its Foundation run 33888582957, job 101074381775, is likewise queued before checkout with steps=[] and labels:["ubuntu-24.04"]; CodeQL PR 33888583016, Security 33888582989, and SAST 33888582959 are queued.

Keep this issue open until #63 receives exact-head hosted/review evidence and integrates normally; then #65 must non-force adopt protected shared-kernel truth and reacquire exact-head consumer evidence. No predecessor GREEN transfer, bypass, source copy, force-push, or premature close.