Repository navigation
security(workforce-validation): bind component projections to tenant and validity-study authority #412
Description
Finding
Fresh review of canonical PR #235 at exact 095bae6e7115e20b5d76cd41d87772e7c4297d97 found a scope-integrity gap in the new #411 final_weight_component_evidence_resolution service.
The read port is called with tenant_record_id and validity_study_id, but BaseWeightComponentEvidence and AdjustmentComponentEvidence do not carry either coordinate. The corroborator therefore cannot verify that a returned projection actually belongs to the requested tenant/study; it can only verify receipt identity/digest/version plus method/artifact semantics. A buggy or malicious adapter can return a same-shaped projection sourced from another tenant/study and, if the receipt coordinates happen to match, the cross-owner service has no provenance field with which to reject it.
This is distinct from #410 structural canonicalization and #411 immutable receipt binding. The issue is owner-scope provenance on the normalized component projection itself.
Required contract
BaseWeightComponentEvidenceandAdjustmentComponentEvidencemust carry exacttenant_record_idandvalidity_study_idcoordinates from the native owner evidence they project.- Canonical reconstruction must include those coordinates so exact runtime type cannot hide or alter scope provenance.
corroborate_final_weight_component_evidence(...)must reject any component whose tenant or validity-study identity differs from the final-weight/binding scope before accepting component semantics or chronology.- Adapter implementations in feat(workforce-validation): adopt registry into owner persistence #248 or a verified successor must derive these coordinates from the native owner authority record, not from caller echo, mutable lookup state, cross-context SQL, or inferred receipt naming.
- The normalized projection remains value-minimized: no row-level weights, response values, protected auxiliary values, or foreign source rows are added.
RED acceptance
- A base-weight projection with matching receipt reference/digest/version/method/artifact but a different
validity_study_idis returned and must fail closed. - A specialized adjustment projection with matching receipt and transform semantics but a different
tenant_record_idis returned and must fail closed. - Canonical reconstruction of either projection must reject hidden/truncated scope coordinates rather than normalize them away.
- The successful path must prove the returned component projections carry the same tenant/study authority as the final-weight receipt and component binding.
Completion boundary
Do not close for issue prose or adapter convention. Completion requires source-first RED → causal GREEN on canonical #235, exact-head owned test/docstring/edge acceptance, installed-wheel/package/PostgreSQL/security gates, qualifying independent review, protected integration, and durable #248 (or verified successor) projection from native owner evidence after normal parent integration.
Activity
seonghobae commentedon Sep 19, 2026
#412 source repair advanced on canonical PR #235; keep this issue open until hosted/protected acceptance.
Fresh exact source lineage:
65e711df426a1336c3b7c43d1dae6917a4951283: added scope-provenance regressions requiringBaseWeightComponentEvidenceandAdjustmentComponentEvidenceto carry ownertenant_record_id+validity_study_id, with hidden-structure fail-closed cases;313b4b9e539df795d3e47eed6d57bf3f0f59a25e: made both normalized projections scope-bound, included scope in canonical reconstruction, and added_require_component_scope(...)before scientific semantic/chronology acceptance;f6c060031819a50d2eaa1674104739c830b6f6f6: updated the existing science(workforce-validation): bind final-weight lineage to exact typed component receipts #411 corroboration regressions and added explicit wrong-study base / wrong-tenant specialized evidence rejection while preserving exact receipt and transform checks.The read port still receives tenant/study lookup coordinates, but returned projections must now independently prove the same scope; caller echo is not sufficient evidence for durable adapters. #248 or a verified successor must derive these fields from the native component authority record after normal parent integration.
This is source-established repair only. Exact-head Foundation/Security/SAST/CodeQL are queued, no qualifying independent APPROVED review exists yet, and package/PostgreSQL/100% owned coverage/protected integration/durable adoption remain required. Do not close #412.
seonghobae commentedon Sep 19, 2026
#412 edge closure remains intact on current canonical #235 exact
4e41e8f427dd3047e9326dca83eeb51ef34501dc.de1751a763da8b3866b3d547a415520d1e59e626added explicit truncated-scope regressions for both base and specialized normalized projections in addition to hidden trailing structure. The later1c703e3e...→4e41e8f4...change is a separate #411 governed-use-currentness repair and preserves #412 tenant/study provenance checks. #412 remains open until exact-head hosted/package/PostgreSQL/security/independent review, protected integration, and durable #248 native-owner scope projection are proven.