workforce-validation: cover exact permitted-field runtime rejection

[seonghobae]

Finding

Exact #235 predecessor e87d28a32683c6e6f115b3d13645b7d263451795 produced a real hosted Foundation RED in run 33981328157, Repository quality job 101346954404. Checkout, exact-head proof, Python/Node setup, compile, runner-image validation, Foundation pack validation, dependency hygiene and toolchain installation all passed. Candidate-evidence, HRIS-kernel, Keyverse, migration, Naruon, offer, requisition, selection, Job Analysis and People API suites all reached their required 100% statement/branch coverage.

The only failure was services/workforce-validation-api: all 25/25 tests passed, but registry.py ended at 99.04% because the fail-closed _detach_policy(...) branch for a permitted_fields element that is not an exact built-in string remained unexecuted. PostgreSQL contracts were correctly skipped after this unit/coverage RED.

This is not dead code and the 100% gate must not be weakened. Keyverse's generic validation can accept a string subtype while Workforce Validation deliberately tightens retained policy evidence to exact built-in strings before purpose-bound authorization. The missing branch therefore required a hostile subtype regression, not production deletion or relaxation.

Minimum repair and exact-head GREEN

Ordinary successor dd95dd7256f37aab2c4f26aa1fb43e8c867f4e4d changes only services/workforce-validation-api/tests/test_policy_runtime_integrity.py. It makes the hostile string subtype hashable with ordinary str.__hash__ so it can inhabit an immutable frozenset, then proves an executable string subtype inside permitted_fields is rejected before caller-defined equality/inequality behavior or persistence can execute. Production code, authorization semantics, SQL, migration, workflow, manifest, dependency inventory, PostgreSQL contracts and the 100% threshold are unchanged.

Foundation 33986151272, Repository quality job 101359888042, is terminal SUCCESS on exact dd95dd725...; owned unit/service contracts and isolated PostgreSQL contracts pass. SAST 33986151255 is also terminal SUCCESS.

The issue remains open because #235 is not protected-integration-ready. Security 33986151270 fails closed only at dependency-review support: exact checkout succeeds, the public dependency comparison remains unavailable, and the pinned action is skipped. Canonical owner .github#810. CodeQL 33986151302 fails only after both Python and Actions compatibility jobs successfully request current-head dispatch and then cannot obtain the terminal central verdict; the active dispatcher identity/allowlist owner incidents are .github#1927/#1929. Those foreign control-plane failures must not be converted into an Orgmetra source workaround or synthetic GREEN.

All current #235 review threads are resolved, but submitted reviews remain COMMENTED-only with no qualifying APPROVED review. Keep #255 open through normal #235 protected integration, or until a verified successor fully carries this regression and evidence. Do not suppress the branch, lower coverage, broaden accepted runtime types, transfer predecessor evidence, add a no-op retrigger commit, or bypass required gates.

[seonghobae]

Fresh exact-successor status: #235 remains dd95dd7256f37aab2c4f26aa1fb43e8c867f4e4d. New current-head runs have materialized but are not acceptance yet: Foundation 33986151272 (Repository quality 101359888042, queued with no runner/steps), Security 33986151270 queued, SAST 33986151255 queued, CodeQL 33986151302 pending. Do not transfer predecessor e87d28a... coverage evidence. #255 stays open until this exact successor demonstrates 100% owned statement/branch coverage plus normal required controls and protected integration.

[seonghobae]

Current owner-path update for #255: the test-only repair remains exact dd95dd7256f37aab2c4f26aa1fb43e8c867f4e4d, and its Foundation 33986151272 is still terminal SUCCESS with the 100%/PostgreSQL acceptance described above. The remaining #235 blockers have now become terminal and are external to this coverage repair: SAST 33986151255 succeeded; Security 33986151270 failed at the fail-closed Dependency Review support probe before the pinned action ran (canonical central availability owner .github#810); CodeQL 33986151302 failed only after both actions/python compatibility jobs successfully requested current-head dispatch and then received no authenticated terminal verdict (central owner .github#1927/#1929, after protected #1932/#1926 source repairs).

Therefore #255 is not reopened as a source defect and does not need another test/source successor. Keep it open until #235 receives normal required evidence/review and protected integration, or a verified successor fully carries this regression. No leaf retrigger commit, Dependency Review skip, CodeQL status synthesis, or predecessor-evidence promotion.