Finding
Draft #235 introduced ValidationPrincipal as authenticated Keyverse identity evidence for the workforce_validation application boundary. The predecessor runtime type was @dataclass(frozen=True, slots=True), which did not provide structural immutability: a retained reference could be rewritten with object.__setattr__ after constructor validation. read_validity_study(...) exact-type-checked that object and then used its tenant, actor reference and scopes in purpose-bound authorization, so post-construction mutation could make authorization consume an identity state that was never accepted by the constructor.
This is distinct from #236, which repaired repository-returned ValidityStudyRecord evidence.
Test-first repair
38536298b0da4969262c232305af19628328005c: causal regression. An accepted principal must reject object.__setattr__ attempts against tenant_record_id, actor_reference, and granted_scope_codes, and all original values must remain intact. No hosted RED is claimed because the branch advanced before this test-only head executed.e0ff34701967d7b4c29c13f42b3989e05f68dbab: root repair. ValidationPrincipal is a slotless tuple-backed validating value object with keyword construction, exact operational UUID / opaque actor-reference / exact-frozenset scope validation and read-only properties.
#239 is complementary, not a replacement: tuple backing prevents post-construction rewrite but low-level tuple.__new__(ValidationPrincipal, (...)) can bypass the validating constructor. Test-first 60f5ba9d... and production 4ef7ad130... make read_validity_study(...) reconstruct/revalidate principal storage before Keyverse request construction/evaluation. #240 then adds inert fail-fast repository-capability validation before that authorization path without altering principal storage or reconstruction.
The canonical #235 branch is now exact ccb5c0c58dc74c1d7eee59431e6337c207fcac35. Current exact-head Foundation 33954469089 / Repository quality 101275139627 is queued before checkout; Security 33954468968, SAST 33954468946, and CodeQL PR 33954468879 are non-terminal. Current-head hosted/security/formal approval evidence remains required.
Keep this issue open until the exact successor obtains current owner tests/100% statement+branch coverage, executed PostgreSQL owner-schema/#238 acceptance, applicable security/review evidence, and normal protected integration. Do not self-approve, weaken a gate, or treat tuple-backed in-process evidence as hostile-interpreter isolation.
Finding
Draft #235 introduced
ValidationPrincipalas authenticated Keyverse identity evidence for theworkforce_validationapplication boundary. The predecessor runtime type was@dataclass(frozen=True, slots=True), which did not provide structural immutability: a retained reference could be rewritten withobject.__setattr__after constructor validation.read_validity_study(...)exact-type-checked that object and then used its tenant, actor reference and scopes in purpose-bound authorization, so post-construction mutation could make authorization consume an identity state that was never accepted by the constructor.This is distinct from #236, which repaired repository-returned
ValidityStudyRecordevidence.Test-first repair
38536298b0da4969262c232305af19628328005c: causal regression. An accepted principal must rejectobject.__setattr__attempts againsttenant_record_id,actor_reference, andgranted_scope_codes, and all original values must remain intact. No hosted RED is claimed because the branch advanced before this test-only head executed.e0ff34701967d7b4c29c13f42b3989e05f68dbab: root repair.ValidationPrincipalis a slotless tuple-backed validating value object with keyword construction, exact operational UUID / opaque actor-reference / exact-frozenset scope validation and read-only properties.#239 is complementary, not a replacement: tuple backing prevents post-construction rewrite but low-level
tuple.__new__(ValidationPrincipal, (...))can bypass the validating constructor. Test-first60f5ba9d...and production4ef7ad130...makeread_validity_study(...)reconstruct/revalidate principal storage before Keyverse request construction/evaluation. #240 then adds inert fail-fast repository-capability validation before that authorization path without altering principal storage or reconstruction.The canonical #235 branch is now exact
ccb5c0c58dc74c1d7eee59431e6337c207fcac35. Current exact-head Foundation33954469089/ Repository quality101275139627is queued before checkout; Security33954468968, SAST33954468946, and CodeQL PR33954468879are non-terminal. Current-head hosted/security/formal approval evidence remains required.Keep this issue open until the exact successor obtains current owner tests/100% statement+branch coverage, executed PostgreSQL owner-schema/#238 acceptance, applicable security/review evidence, and normal protected integration. Do not self-approve, weaken a gate, or treat tuple-backed in-process evidence as hostile-interpreter isolation.