security(workforce-validation): authorize owner-provenance fields before re-resolution #418

Finding

#417 added authoritative final-weight and component-binding re-resolution before component proof issuance. Its first production repair still authorized only _BASE_READ_FIELDS / _ADJUSTMENT_READ_FIELDS, then read, canonically reconstructed, and exactly compared the full FinalAnalysisWeightAuthorityRecord and FinalWeightComponentBindingAuthorityRecord.

That created a new least-privilege false-GREEN: a policy permitting only component projection fields could authorize successfully while final-weight/binding owner provenance fields were subsequently consumed outside the purpose-bound requested-field set.

Ordinary-forward repair lineage

• 7947cb476164ac2692127a901f3d2787c68a2161 — source-first RED: a base-only policy containing component projection fields but omitting final-weight/binding provenance fields must raise AuthorizationDeniedError before final-weight, binding, base, or adjustment owner reads. The valid base-only policy explicitly permits the provenance field set plus base projection fields and still excludes adjustment-component-only transform fields.
• bdc07fc4c365c46253e565cfb861c4d8f16b5f3b — causal production repair: derive _OWNER_PROVENANCE_READ_FIELDS from the authoritative sibling owner read contracts plus tenant_record_id / validity_study_id, require that union together with _BASE_READ_FIELDS, and add _ADJUSTMENT_READ_FIELDS only when the canonical final-weight chain names a governed specialized adjustment.
• 43531a6277d5231466dba471dcfbd956439d1737 / 9a62154bcac3dd99cb752cc2742d2e0a08d8b940 — align full-resolution and authorization fixtures with the explicit provenance field contract. These test-only commits do not weaken the production boundary.

Current canonical #235 head is 9a62154bcac3dd99cb752cc2742d2e0a08d8b940. The RED/repair lineage is source-established only; no predecessor hosted verdict transfers.

Retained invariants

• purpose-bound authorization executes before the first final-weight, binding, base, or adjustment owner read;
• audit correlation remains final_weight_component_evidence_resolution:<exact final analysis-weight receipt tail>;
• security(workforce-validation): re-resolve final-weight and binding owner authority before proof issuance #417 final-weight and binding owner records are re-resolved by immutable receipt identity, reconstructed canonically, and required to match exactly before component access;
• security(workforce-validation): authorize component-evidence resolution before owner reads #414/security(workforce-validation): authorize native owner scope fields before component reads #416 field minimization remains meaningful: base-only corroboration does not request adjustment-component-only method/input/configuration/evidence-kind fields;
• science(workforce-validation): bind final-weight lineage to exact typed component receipts #411 deterministic binding, security(workforce-validation): bind component projections to tenant and validity-study authority #412 native-owner scope/currentness, security(workforce-validation): prevent public forging of corroborated component resolutions #413/security(workforce-validation): close tuple.__new__ bypass on component-resolution issuance #415 sealed result issuance remain unchanged;
• no row-level weights, protected attributes, foreign application-table values, source-copy, or cross-context SQL are introduced.

Completion boundary

Do not close on source repair alone. Completion requires exact-head Workforce Validation tests and 100% owned statement/branch/docstring/edge evidence, installed-wheel and PostgreSQL acceptance, Foundation/Security/SAST/CodeQL GREEN, qualifying independent approval, normal protected #235 integration, and durable #248 adoption of both #417 owner provenance and #418 field-level authorization.