Repository navigation
fix(organization): reject nested timezone behavior before hierarchy-review export comparison #290
Description
Finding
Canonical owner is PR #96 (feat/organization-hierarchy-change-review). Exact predecessor under review: 6573a6293db49632c525f0979973377869b4817c on protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f.
The process-local post-issuance integrity check still has one narrower nested-runtime gap. canonical_json() captures direct slot values and state_matches_issuance(...) verifies that each outer runtime type matches the issuance snapshot before evaluating current_value != issuance_value. For recorded_at, however, an exact built-in datetime may retain a caller-defined tzinfo. After issuance, low-level object.__setattr__ can replace recorded_at with another exact built-in datetime whose nested timezone object has executable utcoffset() behavior. The outer type check passes and Python datetime equality invokes that nested caller-owned behavior before the export boundary fails closed.
A source-level counterexample against the predecessor confirms that comparing such a substituted datetime with the issued built-in-UTC datetime executes the custom utcoffset() implementation. This is not a durable authorization or Python-sandbox claim; it is a checked-versus-used nested representation defect inside #96's stated process-local defense-in-depth boundary.
Required repair
- Add a test-first regression that substitutes an exact built-in
datetimecarrying an executable customtzinfoafter issuance, callscanonical_json(), requires the packet to fail closed, and proves the custom timezone callback was never invoked. - Apply the minimum causal source fix in the closure-bound export comparison: before datetime equality, require both current and issued
tzinfoobjects to have the exact built-in fixed-offset timezone runtime type captured by the packet runtime. Do not reopen mutable module bindings and do not claim protection against deliberate closure/default/global/native-memory mutation. - Preserve valid canonical JSON behavior, one-snapshot issuance/export, single-use issuance, digest verification, all fix(organization): seal post-issuance export representation and snapshot consistency #279–fix(organization): bind hierarchy-review transitive validation authority #289 invariants, and exact owned statement/branch coverage at 100%.
- Keep ADR 0096, hierarchy-review TRACEABILITY, package README and CHANGELOG code-current. Hand the durable nested-runtime principle to docs: maintain durable product-technical gap baseline #100 rather than editing
docs/product-technical-gap-baseline.mdfrom this lane. - Reacquire exact-head Foundation/security/SAST/CodeQL/model-backed evidence after the repair. Predecessor checks do not transfer.
- feat(core): apply reviewed Organization hierarchy changes #119 continues to own durable same-tenant re-resolution, concurrency, authoritative system/audit clock, immutable persistence, audit/outbox and mutation authority after normal feat(core): add governed Organization hierarchy-change review #96 protected integration.
No force push, destructive rebase, self-approval, routine administrator bypass, gate weakening, mutable sibling-source copy or premature Close/merge is authorized.
Activity
seonghobae commentedon Sep 10, 2026
Execution evidence for the canonical #96 lane:
6573a6293db49632c525f0979973377869b4817c: an exact built-indatetimecarrying caller-definedtzinfopasses the outer type check and Python datetime inequality invokes the customutcoffset()before the export verifier can fail closed.d2969bb118a4e79d6e36353e31d83018a259cd7eaddstest_export_rejects_nested_timezone_substitution_before_datetime_comparison, requiringcanonical_json()to reject the changed packet and proving the substituted timezone callback count remains zero. No hosted RED is claimed for this superseded test-only head; no pull-request workflow run materialized before the causal source commit.03b0d865741372084f7b11eca85932767a3e14a6captures the built-indatetimeand fixed-offset timezone runtime types inside_build_packet_runtime()and checks nested timezone type before datetime equality. The repair is one ordinary descendant commit of the test-only head and changes onlyreview.py(+11/-4).Falsewith zero calls into the executable custom timezone object. This is not substituted for hosted acceptance.50bc0d12..., README6114624d..., TRACEABILITY625a39db..., and ADR 009681ed7555...now document the same narrow nested-runtime boundary and preserve feat(core): apply reviewed Organization hierarchy changes #119's durable authority.Current #96 exact head is
81ed7555fd030967356c5ff9d1c698b6070e2e8a. Fresh Foundation34439908483, Security34439908493, SAST34439908512, and CodeQL34439908521exist but are queued. Predecessor GREEN/RED evidence does not transfer. Keep this issue open until the exact current head has admissible hosted evidence and #96 integrates normally.seonghobae commentedon Sep 10, 2026
Current-head correction after coverage-path review: the first causal source repair
03b0d865741372084f7b11eca85932767a3e14a6checked nested timezone type on both the mutable retained datetime and the closure-private issuance datetime. The issuance-side true branch is unreachable under this package contract because_validate_issuance_timestampalready requires an exact built-in datetime with built-in fixed-offsettzinfobefore that immutable issuance value is stored. Rather than manufacture a closure-tampering test merely to cover an impossible branch, ordinary descendant5ffdf0dbe2c6445aa5b115af24b3ae33951b9e21removes only that duplicate issuance-state recheck. The current guard still inspects the mutable retainedrecorded_atnested timezone before equality, so the #290 counterexample remains fail-closed without executing callerutcoffset().CHANGELOG
d25b4244..., READMEb0457426..., TRACEABILITYee2358bb..., and ADR 009670212e6e...now document that reachable authority boundary. Current #96 exact head is70212e6e00e0e3c0104b2444aadd7ac01880847b; fresh Foundation34440405579, Security34440405530, SAST34440405543, and CodeQL34440405532remain queued. No predecessor verdict transfers and no current-head GREEN is claimed.