fix(authz): protect purpose-bound runtime integrity

CHANGELOG.md

@@ -18,7 +18,7 @@ All notable changes to Orgmetra will be documented in this file.
 - `employment_record_version.employment_concurrency_code` constrained to `exclusive` or `concurrent`.
 - ADR 0005 for exclusive employment and staffable seats.
 - `orgmetra_hris_kernel` 0.3.0 with identity-scoped bitemporal resolution, assignment-employment coverage, allocation-portfolio checks, and a Memorial Hospital RN correction case at 100% statement and branch coverage.
-- `employment_record_version` and `position_record_version` so employment and position identity stay stable across retroactive corrections.
+- `employment_record_version` and `position_record_version` so corrections no longer mint a new employment or position identifier.
 - `assignment_record.employment_record_id` bound to the same person as the covering employment.
 - `orgmetra_keyverse_adapter` that binds an opaque Keyverse subject to a person and rejects passwords, passkeys, and tokens.
 - Design tokens for the repeating HR actions: approve, review, correct, request evidence, compare, export, and escalate.
@@ -59,6 +59,7 @@ All notable changes to Orgmetra will be documented in this file.
 
 - Predictive-validity cases fail closed when selection evidence, Job scope, study criterion, converted worker, or system-recorded visibility does not match; the normalized case relation is tenant-qualified, append-only, TRUNCATE-protected, and forced through row-level security.
 - Purpose-bound PII authorization now fails closed across active tenant, authenticated actor tenant, resource tenant, resource kind, purpose, operation, operation-specific Keyverse scope, and requested-field subset; malformed/wildcard-like attributes, mutable field/scope collections, reserved UUID sentinels, and cross-tenant confused-deputy contexts are rejected before protected values are returned. Authorization requests and allow/deny evidence now also require and preserve one namespaced opaque target-resource reference, so immutable audit correlation identifies the exact HR record without copying its protected values. Authorization evidence otherwise contains governance metadata and field names only, with stable denial reasons and actionable next steps rather than PII.
+- Active-PR authorization runtime-integrity hardening at `orgmetra_keyverse_adapter` additionally requires exact built-in UUID, string, and `frozenset` values plus exact policy/request classes before evaluation, so subclass-controlled equality, membership, and validation bypasses fail closed. This is active-PR refinement to ADR 0008 and is not yet protected-`develop` truth.
 - LLM output constrained to draft evidence.
 - No direct cross-service application-table access.
 - Service-owned database schemas and roles inside the initially shared physical PostgreSQL cluster.

docs/TRACEABILITY.md

@@ -21,7 +21,7 @@
 | Tenant-safe atomic outbox claiming and crash recovery | Integration Hub dispatcher boundary | `outbox_delivery_record` pending/expired-lease claim indexes plus `claim_outbox_delivery(...)` | PostgreSQL already-expired-new-lease rejection, due-order claim, live-lease exclusion, pre-exhaustion takeover with `lease_expired` evidence, retry-budget claim bound, tenant-context binding, opaque-worker validation, and bounded-lease contract | ADR-0006 | implemented_on_active_pr |
 | Owner-bound outbox completion, retry, and terminal dead-letter escalation | Integration Hub dispatcher boundary | immutable `outbox_delivery_record.maximum_attempt_count`, `complete_outbox_delivery(...)`, `retry_outbox_delivery(...)`, `dead_letter_outbox_delivery(...)`, `outbox_delivery_escalation_record` | PostgreSQL foreign/stale-owner denial, dispatcher-budget-signature rejection, direct-terminal-DML rejection, stored-budget exhaustion, retry-attempt-N+1 denial, exhausted expired-lease non-reclaimability, recorded-owner terminalization, nonterminal-escalation rejection, terminal non-reclaimability, and append-only escalation evidence | ADR-0006 | implemented_on_active_pr |
 | Predictive-validity case integrity | Workforce Validation | `validity_study`, normalized `validity_study_case_record`, exact `selection_decision`, sealed `decision_evidence_set`, governed `candidate_worker_conversion_record`, `criterion_observation` | `test_validity_study_case_postgres.sh`: legacy loose-link write rejection; exact evidence-set ID, Job, criterion and worker mismatch rejection; study/observation system-recorded visibility boundaries; governed upstream decision/evidence/conversion lineage from the evidence-sealing and candidate-worker conversion contracts; UPDATE/DELETE/TRUNCATE protection; missing/foreign-tenant RLS denial. Statistical estimation remains subsequent work. | ADR-0001, SIOP Principles 5th ed., 29 C.F.R. Part 1607 | implemented_on_protected_main |
-| Purpose-bound PII access | Security architecture / Keyverse adapter boundary | `PurposeBoundAccessPolicy`, `PurposeBoundAccessRequest.resource_reference`, `AuthorizationDecision.resource_reference` | exact tenant/actor/resource binding, exact opaque target correlation for allow/deny audit evidence, resource/purpose/operation matching, operation-specific scope, field-subset minimization, malformed-attribute rejection, reserved-UUID rejection, PII-minimized denial evidence, and exact 100% owned statement/branch coverage | ADR-0008 | implemented_on_protected_main |
+| Purpose-bound PII access and authorization decision integrity | Security architecture / Keyverse adapter / trusted service composition | `PurposeBoundAccessPolicy`, `PurposeBoundAccessRequest.resource_reference`, `AuthorizationDecision` | exact tenant/actor/resource binding; exact opaque target correlation; resource/purpose/operation/scope/field minimization; exact built-in runtime types; UUID detachment; evaluation-time policy/request revalidation; verdict/reason/field coherence; consumer-side decision revalidation; regressions proving no mutable module/closure registry is represented as an issuance capability; exact 100% owned statement/branch coverage | ADR-0008 | implemented_on_active_pr |
 | Least-privilege API capability | Keyverse gateway boundary | operation scope conceptual | structural per-operation scope and confused-deputy contract tests | ADR-0002 | implemented_on_active_pr |
 | Client-safe failure correlation | API error boundary | `support_reference` conceptual | error disclosure and support-lookup tests | ADR-0002 | implemented_on_active_pr |
 | Foundation artifact integrity | Repository governance | deterministic `manifest.json` file inventory | SHA-256/byte/line validation plus Python/Node inventory-equivalence regression and explicit dispatcher/validity/criterion/job-analysis migration and execution-contract provenance regression | ADR-0001 | implemented_on_active_pr |
@@ -30,7 +30,7 @@
 
 | External contract | Orgmetra owner boundary | Integration style | Required evidence | ADR | Maturity |
 |---|---|---|---|---|---|
-| Keyverse identity and authorization | API Gateway / purpose-bound authorization | Published OIDC/API identity and scope contract plus Orgmetra-owned `orgmetra_keyverse_adapter` policy evaluation | tenant/actor/resource agreement, exact opaque target-resource reference, purpose, operation-specific scope, requested-field minimization, opaque subject, no stored credentials or protected values in authorization evidence | ADR-0002, ADR-0008 | implemented_on_protected_main |
+| Keyverse identity and authorization | API Gateway / purpose-bound authorization | Published OIDC/API identity and scope contract plus Orgmetra-owned `orgmetra_keyverse_adapter` policy evaluation | tenant/actor/resource agreement, exact opaque target-resource reference, purpose, operation-specific scope, requested-field minimization, opaque subject, no stored credentials or protected values in authorization evidence; production policy values come from trusted Orgmetra service composition/policy sources rather than request-controlled data; Python decision objects are revalidated PII-minimized data, not unforgeable capabilities against arbitrary same-process code | ADR-0002, ADR-0008 | implemented_on_active_pr |
 | naruon communication and calendar | Integration Hub | Published API/event adapter | idempotency, delivery audit, no direct table access | ADR-0002 | planned |
 | Psychometrics Commons @ `cc5850a0d1eacbbf16d03075534fce460a8286e6` | Workforce Validation | Immutable response/result snapshot contract | pinned revision, model/version/provenance snapshot, immutable result linkage, no direct application-table access | ADR-0002 | accepted_architecture |
 | fast-mlsirm @ `fb67ced09d8ee00542c05d56374537a9a7239751` | Workforce Validation | Published `orgmetra.fast_mlsirm.v1` result contract; direct calls only from approved offline validation worker | pinned revision, contract identifier, backend/result provenance, CPU/GPU parity evidence where material, no duplicated kernel | ADR-0002 | accepted_architecture |

manifest.json

@@ -29,9 +29,9 @@
     },
     {
       "path": "CHANGELOG.md",
-      "sha256": "f2d2e0b488c0440533effa821808f2f17e37d92f8fb586174c2fdb594f760ca5",
-      "bytes": 17539,
-      "lines": 77
+      "sha256": "8712d0ec7442acb52fcb5776988799da1d8550a90bcced6630273af0be6468ba",
+      "bytes": 17907,
+      "lines": 78
     },
     {
       "path": "CLAUDE.md",
@@ -197,8 +197,8 @@
     },
     {
       "path": "docs/TRACEABILITY.md",
-      "sha256": "dbf6fd91375ea28e05456d2a0c9ba629506cbac6f52f5dfda61ae68db2395f7e",
-      "bytes": 11462,
+      "sha256": "d5b57dfa3b4b5c4a408062b6a47f947080aa98eb4b82ffaf130a85ac17c80892",
+      "bytes": 11841,
       "lines": 40
     },
     {

packages/keyverse-adapter/src/orgmetra_keyverse_adapter/__init__.py

@@ -1,10 +1,9 @@
 """Keyverse identity binding and purpose-bound authorization for Orgmetra.
 
 Orgmetra never stores passwords, passkeys, or raw credentials on a person
-record. Use ``bind_identity_subject`` after Keyverse authenticates the actor,
-then evaluate the authenticated subject, tenant, purpose, operation, scope, and
-requested field set against an Orgmetra-owned purpose-bound policy before
-returning protected HR data.
+record. Keyverse authenticates identity and scopes; Orgmetra's trusted service
+composition supplies HR policy. The exported value objects validate data but do
+not pretend to be unforgeable capabilities against arbitrary same-process code.
 """
 
 from orgmetra_keyverse_adapter.authorization import (
@@ -14,6 +13,7 @@
     PurposeBoundAccessRequest,
     evaluate_purpose_bound_access,
     require_purpose_bound_access,
+    validate_authorization_decision,
 )
 from orgmetra_keyverse_adapter.binding import (
     CredentialRejectedError,
@@ -31,4 +31,5 @@
     "bind_identity_subject",
     "evaluate_purpose_bound_access",
     "require_purpose_bound_access",
+    "validate_authorization_decision",
 ]