security(core): exact-gate audit timezones before provider callbacks

[seonghobae]

Verified finding

Canonical owner is shared HRIS-kernel PR #63. At predecessor e29d180ce2e2bc531abc817fffea4eb6096c53ce, exact AuditOutboxEvent.__new__() validated only the outer datetime type and _freeze_timestamp(...) then invoked value.utcoffset() on any caller-supplied tzinfo. Python's timezone protocol is subclass-extensible, so this crossed executable provider behavior before the canonical audit trust boundary. This is inconsistent with the already-established #209 Job Analysis contract and with #179/#211 audit callback hardening.

Test-first repair

Ordinary non-force successors on canonical #63:

• 1d24cef77d8b843f694c5982c5e4ceaf786eb864 — test-first runtime tripwire: caller-defined tzinfo must be rejected with calls == 0; exact ZoneInfo("Asia/Seoul") remains accepted and detached to exact UTC; representable-range failure uses a standard-library fixed offset.
• 7216153d55e2767716357d3171030d4aa8a64586 — production gate: exact built-in datetime, then exact standard-library datetime.timezone or zoneinfo.ZoneInfo, before offset resolution.
• c9bbbef9740f6349930ff5ab79d39d0902f8a102 — aligns the canonical manifest-owned test_audit_outbox.py contract.
• 48af3c30dcf35724c719bac7c5f6202b3c2b4a0c — removes branches made unreachable by excluding arbitrary providers while retaining real overflow normalization.
• 16dce30fea69991277c558688da704554c08b0e8 — reseals only the two manifest-owned artifacts changed by the production repair.

The predecessor is a real control-flow RED: the new tripwire raises if its utcoffset() executes, whereas predecessor _freeze_timestamp called that method before rejecting the provider.

Hosted RCA and exact coverage successor

Foundation CI 33904960273 acquired the intended GitHub-hosted ubuntu-24.04 runner (runner_id=1001672934) and checked out exact 16dce30fea69991277c558688da704554c08b0e8. Foundation validation and dependency hygiene passed, and all 218 HRIS-kernel tests passed, but the job failed the required 100% coverage gate: audit.py was 97% with exactly three uncovered rejection lines, 71, 192, and 239. PostgreSQL contracts were skipped because the unit/service step failed first. This supersedes the earlier pre-checkout queue description.

The three misses are defensive structural branches introduced/retained by the current immutable-event design, not production failures: _canonical_timestamp(...) rejects a low-level exact tuple carrying non-canonical time, AuditOutboxEvent.__new__() rejects subclass construction, and to_cloudevent() rejects a low-level tuple subclass before export.

Ordinary test-only successor 72070cb4b8d636825ce5b1a326df4c296596ed7e adds exact regressions for those three branches in test_audit_runtime_type_integrity.py without changing production code or manifest-owned artifacts. It uses low-level tuple.__new__ only as adversarial test construction and verifies that malformed/subclass values fail closed at the canonical construction/export boundaries. This is the minimal causal repair for the observed hosted RED rather than lowering the coverage gate.

Current acceptance state

Current #63 exact head is 72070cb4b8d636825ce5b1a326df4c296596ed7e over protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.

Exact-head Foundation CI 33936088421 / Repository quality job 101224196516 is now terminal GREEN on the intended GitHub-hosted ubuntu-24.04 runner (runner_id=1001677542). Exact candidate checkout, foundation-pack and dependency-hygiene validation, owned unit/service contracts, PostgreSQL contracts in isolated containers, and read-only validation all completed successfully. This supersedes the stale statement that the successor had not yet run and materially proves the causal coverage repair on the current head.

The ordinary protected path is still incomplete: current exact-head Security Scan 33936088403, SAST Semgrep 33936088456, CodeQL PR 33936088409, OpenCode 33936086812, Strix 33936086809, and Noema 33936086817 remain non-terminal, while PR Review Merge Scheduler 33936086820 is GREEN. Submitted formal reviews are still COMMENTED; there is no ruleset-qualifying APPROVED review. All known inline review threads are resolved. #63 therefore remains Draft and must not be merged or marked Ready until the remaining exact-head workflows and ordinary review/protection requirements are satisfied.

No source was copied into #65 or Assignment descendants. No force-push, destructive rebase, self-approval, gate weakening, administrator bypass, or no-op retrigger was used.