Repository navigation
fix(organization): bind hierarchy-review transitive validation authority #289
Description
Verified owner finding
PR #96 captures the top-level issuance validator (#286) and direct snapshot/payload/serializer/live-reference helpers (#287), but the captured validator function still resolves its own module-global dependencies at call time. On exact predecessor 28b050bd131e5aacdbf50ed35da5e3ec7615ec9f, _validate_issuance_snapshot(...) dynamically resolves _validate_reference and the other trust-bearing helpers through its function globals.
A normal same-interpreter consumer can therefore replace review._validate_reference after package import. The already-captured _validate_issuance_snapshot then invokes that replacement. With reference validation replaced by a no-op, an invalid organization_unit_reference="organization_unit:not-a-uuid" can cross issuance validation and be sealed because _payload_from_snapshot requires the runtime type to remain str but does not independently re-establish the reference grammar.
Test-first ordinary-forward commit ce36e705532d245be9e918adeda42f39a67e59e1 adds test_issuance_does_not_trust_mutable_transitive_reference_validator. It requires the invalid Organization Unit reference to remain rejected after the module-level _validate_reference binding is replaced. Hosted RED is not claimed until an exact-head run actually executes.
This is narrower than arbitrary function-global/closure/native-memory manipulation: the defect is ordinary reassignment of a module helper name that a captured trust-authority function still resolves dynamically. It does not establish a Python sandbox and does not move durable uniqueness, authorization, authoritative system time, hierarchy concurrency, or immutable audit/outbox authority out of #119.
Acceptance
Bind the trust-bearing dependencies used by issuance validation/canonicalization so later ordinary module-name reassignment cannot change the semantics of the already-constructed packet runtime. Preserve deterministic canonical JSON and current public behavior for valid packets. Add no alternate authorization path, no durable-authority claim, and do not weaken exact 100% owned statement/branch coverage.
Keep this issue open until #96 or a verified successor carries test-first RED evidence, the minimum causal repair, code-current ADR/TRACEABILITY/README/CHANGELOG, exact-head GREEN evidence, all required workflow evidence, and qualifying review before normal protected integration.
Refs #96 #100 #119 #279 #280 #281 #282 #283 #284 #285 #286 #287 #288.
Activity
seonghobae commentedon Sep 10, 2026
Exact-source RED and repair update:
28b050bd131e5aacdbf50ed35da5e3ec7615ec9fwas fetched from GitHub and executed without source alteration. After package import, assigningreview._validate_reference = lambda *args, **kwargs: Noneallowedorganization_unit_reference="organization_unit:not-a-uuid"to be constructed and sealed;canonical_json()returned evidence instead of rejecting the invalid reference. This is a direct runtime reproduction of the late-global-lookup defect.ce36e705532d245be9e918adeda42f39a67e59e1captures that counterexample. Its hosted Foundation job102705468597never obtained a runner (runner_id=0) and was cancelled after the causal source successor, so it is not represented as a hosted RED.bbe9e526bc2ed3a8bad87e8dfc0c90f8ad0cfbbb: issuance validation binds its first-level validation functions and fixed governance vocabulary; helper functions bind the UUID/pattern/type/time dependencies they rely on; payload canonicalization binds its validation/date/timestamp authorities; JSON serialization binds the selectedjson.dumps. The same counterexample was re-executed against the repaired source and now raises the governedValueErrorfororganization_unit_reference.1475d356..., README8469664b..., TRACEABILITY6aaeaf80..., and ADR 009620e9ab4e...document the repaired boundary. The claim remains process-local ordinary-module-binding integrity only; deliberate mutation of function defaults/closures/globals internals, arbitrary same-process/native execution, and durable uniqueness/authorization/audit authority remain out of scope and feat(core): apply reviewed Organization hierarchy changes #119-owned where applicable.Current source/docs descendant is
20e9ab4e2c843089e078e92c028720581b57ea9b. Exact-head hosted GREEN is still required before acceptance.seonghobae commentedon Sep 10, 2026
Current descendant update: test expansion
e627be7a436b0e01c7c5efb56fc4a84af64e05d5now exercises five ordinary late-binding surfaces against the repaired source:_validate_reference,_DIGEST_PATTERN,_PURPOSE_CODE,_validate_issuance_timestamp, and the modulejsonbinding. Focused local execution is 5/5 PASS. The production repair remainsbbe9e526...; documentation authority remains through ADR descendant20e9ab4e....Exact-head hosted evidence has materialized for
e627be7...: Foundation34424919172, Security34424918712, SAST34424918718, CodeQL34424918710. Foundation job102708002656is still queued withrunner_id=0and no steps, so no exact-head hosted GREEN is claimed. Fresh #96 review enumeration still contains no qualifying independent APPROVED, and all visible inline threads are resolved. Keep #289 open until exact-head gates and review satisfy the protected path.seonghobae commentedon Sep 10, 2026
Hosted exact-head RCA update for #289:
e627be7a436b0e01c7c5efb56fc4a84af64e05d5finally obtained a GitHub-hosted runner. Foundation run34424919172, job102708002656, checked out that exact SHA and reached the installed-wheel hierarchy-review suite. Production statement/branch coverage was 100.00%, and the five new transitive-authority regressions passed. The run nevertheless failed2 failed, 76 passed: the two older concurrency tests intest_packet_runtime_type_integrity.pystill monkeypatched module-global_validate_issuance_timestampand waited for that replacement to execute. #289 intentionally makes the already-constructed packet runtime independent of later module-name replacement, so those tests were asserting the obsolete test seam rather than a production failure.Minimal causal test repair is ordinary-forward
6573a6293db49632c525f0979973377869b4817c. It does not reopen a mutable validator hook or weaken production binding. Instead, both concurrency tests install a thread-localsys.settraceprobe and pause on entry to the already-captured_validate_issuance_snapshotafter issuance has captured its snapshot and acquired its single-use reservation. The tests then exercise the same two invariants: concurrent reissuance must fail while the first issuance owns the reservation, and mutation after snapshot capture must not be sealed as reviewed evidence. Production source is unchanged by this repair.Current #96 head is
6573a629...; its new Foundation34427958099, Security34427958063, SAST34427958070, and CodeQL34427958061have materialized but are still queued/pending at this read. Do not transfere627be7...verdicts to the new head. Keep #289 open until the exact current head gets admissible hosted evidence and the protected review path is satisfied.seonghobae commentedon Sep 10, 2026
Current exact-head acceptance update for #289:
PR #96 remains exact
6573a6293db49632c525f0979973377869b4817cover protecteddevelop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.34427958099, job102717113694: SUCCESS on the exact current head. Exact candidate checkout/proof, compile, Foundation validation/dependency hygiene, installed-artifact Organization hierarchy-review contract, owned unit/service contracts, isolated PostgreSQL contracts and read-only validation all passed. This closes the branch-local hosted GREEN requirement for the fix(organization): bind hierarchy-review transitive validation authority #289 source/test repair without transferring the predecessore627be7...verdict.34427958070, coverage evidence/OpenCode, and Noema34427956790/102720165329: SUCCESS on this exact head.34427958063: still FAILURE only at the fail-closed Dependency Review support/availability boundary; canonical owner remains.github#810. OSV/Trivy/Scorecard do not substitute for the authoritative Dependency Review evidence.34427958061: still FAILURE in both compatibility consumers although later current-head dispatch102724788667succeeded. The current consumer/producer ordering canary is owned by.github#2040comment5612025227; no leaf timing/status workaround is permitted.34427956795, job102719245996: SUCCESS afterRun Strix (quick)completed at04:28:26Zand report collection/artifact upload succeeded. Immutable artifact10136631500(sha256:ee4f6d58e682783cd388a32c9d7fb6af79c05e1613e4d5622118a248eac3434e) contains a materially substantive 2,645-byte package-specific report and well-formed SARIF 2.1.0 (Strix1.5.3, zero results). However it still lacks the machine-readable repository/PR/exact-head/live-base/materialized-file-digest/finding-set receipt required by.github#891; the new consumer canary is.github#891comment5613170518. The GitHub SUCCESS is therefore useful scan evidence but not merge-authorizing Strix provenance evidence yet.APPROVED; all visible inline threads are resolved.The production repair and five transitive-authority regressions therefore have exact-current-head hosted Foundation evidence, but #289 remains open until the shared required workflows/evidence contracts and qualifying review permit normal protected integration. No self-approval, administrator bypass, force push, destructive rebase, predecessor-evidence transfer, synthetic status, or local required-workflow fork is used.