security(people): reject executable hire decision timestamps before offset resolution

[seonghobae]

Verified durable-evidence defect

Canonical People mutation owner is PR #64. Its predecessor validated selection-decision timestamps with an isinstance(value, datetime) path that could invoke caller-defined tzinfo.utcoffset() before durable provenance was accepted. This was the People/hire counterpart of the standard-library timezone-provider boundary in shared HRIS-kernel and Job Analysis.

Test-first repair lineage

• cde8df27fcffc0b4abee57178085ee0f2153c571 requires custom tzinfo and executable datetime subtypes to fail without callbacks while exact datetime.timezone / zoneinfo.ZoneInfo remain accepted.
• 98882232244920f919c0fdaf9b7a2c6ee67879c9 introduced the exact outer/provider gate. That full-file edit accidentally changed two unrelated insert-contract lines; the mistake was retained in history rather than rewritten.
• Ordinary successor 61cba0fe82107c07b979a42e57f6cd64e75cdf8a restored the two unrelated SQL lines; 42d988a7293c083f0d2160e770b4b1cedeb18d52 only added the missing tripwire initializer docstring.
• security(people): reject executable durable hire UUID evidence before identity inspection #216–fix(people): exact-gate durable hire decision provenance text #218 subsequently exact-gated durable UUID/text evidence. security(people): reject executable durable hire row containers before projection reads #219 now exact-gates the enclosing fetchmany() batch/row containers through test-first 5514b745233da940dd730d2c9dfdb8aaf8630e99 and production/current fix(people): protect governed mutation runtime types #64 head adab34478eb8fbaed570b8a620739baa48e6c2f2. security(people): reject executable hire decision timestamps before offset resolution #215 remains intact in ancestry.

Current acceptance state

Exact #64 is open · Draft · mergeable at adab34478eb8fbaed570b8a620739baa48e6c2f2 over protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. Foundation CI 33916898658 / Repository quality 101166034943 plus CodeQL PR 33916898686, Security Scan 33916898671, and SAST Semgrep 33916898683 remain non-terminal before checkout. Hosted GREEN/100% coverage and current-head independent approval are not claimed.

Keep this issue open through exact-current-head hosted/review evidence and ordinary protected integration. No mutable source copy, self-approval, administrator bypass, force-push, destructive rebase, gate weakening, or predecessor-evidence transfer.