Finding
Draft #235 introduced ValidityStudyRecord as @dataclass(frozen=True, slots=True) and described it as immutable persistence evidence. In CPython, object.__setattr__ can still rewrite fields on a frozen+slots dataclass. A repository adapter retaining an accepted exact record could therefore mutate trust-bearing validity-study evidence after constructor validation but before or during application consumption.
This is an Orgmetra workforce_validation owner-boundary integrity defect. It does not justify normalizing legacy public.validity_study, weakening exact runtime checks, or copying another bounded context's source.
Test-first repair
0daaf12a0785d94f243b36c0c99c1d5358594242: causal regression requiring object.__setattr__(record, "study_status_code", ...) to fail and the original status to remain unchanged. Against the predecessor frozen dataclass this contract fails because mutation succeeds. This is causal RED evidence, not a hosted RED claim.b609b0a46b835e4ba4c7f46f51088c5673dcbdb7: root repair replacing only the persistence-record representation with a slotless tuple-backed value object. Construction still exact-validates operational UUIDs, status code and standard-library timezone evidence, detaches timestamps to UTC, and the owner read boundary reconstructs persisted results before target checks/output.
The canonical #235 branch has advanced ordinarily through #237/#238/#239/#240 to exact ccb5c0c58dc74c1d7eee59431e6337c207fcac35; #236 remains in its ancestry and none of those later repairs changes the ValidityStudyRecord representation or persistence-result reconstruction invariant.
Current exact-head Foundation 33954469089 / Repository quality 101275139627 is queued before checkout; Security 33954468968, SAST 33954468946, and CodeQL PR 33954468879 are non-terminal. Prior static reviews re-verified tuple-backed ValidityStudyRecord, but current-head hosted/security/formal approval evidence remains required.
Acceptance
Keep this issue open until #235's exact current head has terminal 100% statement/branch service coverage through canonical Foundation CI, current PostgreSQL owner-schema/#238 acceptance, applicable security/review evidence, and normal protected integration or a verified successor fully carries the regression and structural repair. Do not close merely because the source fix exists on a mutable branch.
Finding
Draft #235 introduced
ValidityStudyRecordas@dataclass(frozen=True, slots=True)and described it as immutable persistence evidence. In CPython,object.__setattr__can still rewrite fields on a frozen+slots dataclass. A repository adapter retaining an accepted exact record could therefore mutate trust-bearing validity-study evidence after constructor validation but before or during application consumption.This is an Orgmetra
workforce_validationowner-boundary integrity defect. It does not justify normalizing legacypublic.validity_study, weakening exact runtime checks, or copying another bounded context's source.Test-first repair
0daaf12a0785d94f243b36c0c99c1d5358594242: causal regression requiringobject.__setattr__(record, "study_status_code", ...)to fail and the original status to remain unchanged. Against the predecessor frozen dataclass this contract fails because mutation succeeds. This is causal RED evidence, not a hosted RED claim.b609b0a46b835e4ba4c7f46f51088c5673dcbdb7: root repair replacing only the persistence-record representation with a slotless tuple-backed value object. Construction still exact-validates operational UUIDs, status code and standard-library timezone evidence, detaches timestamps to UTC, and the owner read boundary reconstructs persisted results before target checks/output.The canonical #235 branch has advanced ordinarily through #237/#238/#239/#240 to exact
ccb5c0c58dc74c1d7eee59431e6337c207fcac35; #236 remains in its ancestry and none of those later repairs changes theValidityStudyRecordrepresentation or persistence-result reconstruction invariant.Current exact-head Foundation
33954469089/ Repository quality101275139627is queued before checkout; Security33954468968, SAST33954468946, and CodeQL PR33954468879are non-terminal. Prior static reviews re-verified tuple-backedValidityStudyRecord, but current-head hosted/security/formal approval evidence remains required.Acceptance
Keep this issue open until #235's exact current head has terminal 100% statement/branch service coverage through canonical Foundation CI, current PostgreSQL owner-schema/#238 acceptance, applicable security/review evidence, and normal protected integration or a verified successor fully carries the regression and structural repair. Do not close merely because the source fix exists on a mutable branch.