Skip to content

security(workforce-validation): remove module-exposed authorized-view sealing capabilities #421

Open
Open
security(workforce-validation): remove module-exposed authorized-view sealing capabilities#421
Labels
bugSomething isn't workingpriority: high

Description

@seonghobae
seonghobae
opened on Sep 19, 2026

Finding

#420 removed tuple-base construction from all 24 exported resolver-issued *View classes, but closure-private issuance was not yet universal. A leading underscore is not a trust boundary: if an owner module exposes the exact *_VIEW_ISSUANCE_MARKER, caller code can allocate an exact runtime object, fill its inert slots with object.__setattr__, copy that marker and bypass the supported resolver.

This is an ordinary in-process capability defect. It does not claim cryptographic resistance against unrestricted Python reflection.

Executable contract

721f847a018e3a0cf52cd008aa70d86396dea5c6 established the package-wide RED: every module owning a public exported *View must expose no importable *_ISSUANCE_MARKER, and a caller-populated raw object must remain unreadable even when every known slot is filled with structurally valid-looking values and caller-owned marker data.

For every repaired view, the supported public resolver remains the only issuer after its existing purpose authorization, authoritative owner read, canonical reconstruction/match, scope/coordinate, chronology/currentness and field-minimization checks. View runtime type or seal is not durable authorization.

Source repair census

The public package surface contains 24 resolver-issued *View classes. Closure-private source sealing now covers 24/24 and the #421 source residual is 0/24.

The final eight ordinary-forward RED→repair pairs were:

  • 5d84a12eac39adc35e5429dbb072fc57396d2aea → ec650728902f2a18e740cbe01f955f91aad51662 — Trimming/Bounding Supersession.
  • 47601be56ab3dc66846338b221d97d649076ae81 → 83d2623c565afc1d25565952079280844f083d19 — Validation Result Supersession.
  • 2b282cf241996386bc796e8e4ac9c6644c3e6270 → 64477a500a99c14de85a16c2d060b919421377e0 — Validation Result Non-Verifiability Supersession v1.
  • 73b027cbfcd3cc781430a875711f45124ecd1ee8 → 3355c3593e16ca79230b0ed9bb7a443c204192de — v2 exact-artifact Non-Verifiability Supersession.
  • d2bcec78c9985f0ecf09fb5560665f7ca65f1e46 → c3d361a051c35534e1df6daddd11e4e8d4eaa41a — Weight Eligibility.
  • 2b39434501078d33998c10daa97394332803db84 → f7b5d3eae6094ba11ad7442ba7d51f754033c512 — Weight Eligibility Supersession.
  • f5698308f6c4e6d8433c6d97222fd733784b4a35 → af6badae32dd45a17789911b03f13c6a9ecce6da — Weight/Variance Compatibility.
  • bb46047b5e81f6bd6634681d81cf1b8f50e40ef3 → 1cf907c30e7d9837ec25f2a860791fdaeb1af1fa — Weight/Variance Supersession.

Each production repair removes only the importable sealing capability, extracts the pre-existing authorization/canonical-owner/currentness logic into an inert-state resolver, and writes the private seal last inside a closure-owned public resolver. No force-push, destructive rebase, self-approval, gate weakening or source-copy of another owner was used.

_RESOLUTION_ISSUANCE_MARKER in final_weight_component_evidence_resolution.py is not part of this 24-view census and remains separately governed by #422; its source repair is dbc2f013062f1aba7b95c316e88f3dfcddfdd079.

Docs/provenance currentization

76d1300deddc8433cd236ada11e41edc9c00831d updates CHANGELOG.md to the 24/24 closure-private truth and explicitly marks prior 1,306-test/4,487-statement/1,070-branch evidence as non-transferable. 89b1334c1a036437ae1f0e37a7058fca8f7aeb82 immediately reseals the manifest entry to CHANGELOG SHA-256 5e71ae06e61eca5738fd62158272ad0eee235584ae48851114ef041da6737a8d, 19,691 bytes and 81 lines.

Current evidence boundary

Current #235 exact head is 731b5e9605f0d4d8f27e45920c68b73da2d44be0. #421 source residual remains zero and its sealing lineage is unchanged. Independent exact-tree verification after additive #423/#424 repair passes 1,441/1,441 service and built-wheel tests with pinned Python 3.12 and setuptools==82.0.1; owned production coverage is 5,186/5,186 statements and 1,116/1,116 branches (100%); Foundation is 23/23; repository/manifest validation, Deprecation-Warning-fail-closed compileall and diff checks pass. PostgreSQL owner-schema, hosted security/model-review verdicts and independent approval remain outstanding.

Completion boundary

Keep this issue open despite source residual 0. Close only after the final exact #235 head has full functional GREEN, 100% owned statement/branch/docstring/edge evidence, pinned installed-wheel METADATA/RECORD/hash/offline-install acceptance, PostgreSQL owner-schema evidence, deterministic provenance validation, terminal Foundation/Security/SAST/CodeQL/model-review gates, qualifying independent approval and normal protected integration. #248 may adopt only protected parent truth through ordinary non-force lineage.

Activity

  1. seonghobae
    added
    bugSomething isn't working
    priority: high
    on Sep 19, 2026
  2. seonghobae
    added a commit that references this issue on Sep 19, 2026

    fix(workforce-validation): hide base-weight view seal

    e190f68

  3. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    #421 base-weight sibling repair at exact head e190f686f42ffa4abad17b7867b7165cab49c832

    The global source-first census identifies BaseWeightAuthorityView as the first unrepaired sibling after the registry anchor. Ordinary child e190f686... removes _BASE_WEIGHT_AUTHORITY_VIEW_ISSUANCE_MARKER from module state and moves issuance into closure-private runtime state. The public resolver remains the only issuer and still completes purpose authorization, static owner capability validation, canonical owner reconstruction/match, chronology/currentness and field minimization before sealing.

    A module-specific marker-copy regression fills every known view slot with plausible data and any obtainable marker-like value; property access remains fail-closed.

    Fresh validation:

    • base-weight authority suites: 48/48 passed
    • owned module: 164/164 statements, 34/34 branches, 100.00%
    • Deprecation Warning fail-closed compileall and git diff --check: PASS

    #421 residual is now 22/24 public-view owner modules. The issue remains open and the PR remains Draft; broad exact-head, installed-wheel/PostgreSQL, hosted gates and independent approval are still outstanding.

  4. seonghobae
    added a commit that references this issue on Sep 19, 2026

    fix(workforce-validation): hide base-weight supersession seal

    90e99e2

  5. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    #421 base-weight supersession sibling at exact head 90e99e2469bd40cc5fb8d523408d1c496bcc3546

    Ordinary child 90e99e246... removes the module-global BaseWeightSupersessionAuthorityView seal and moves verification/issuance into closure-private runtime state. The public resolver still completes purpose authorization, static read capability validation, canonical owner reconstruction/match, exact coordinates and effective-time currentness before sealing. A caller-populated exact object with any marker obtainable from module state remains unreadable.

    Fresh focused validation:

    • supersession suites: 36/36 passed
    • owned module: 172/172 statements, 44/44 branches, 100.00%
    • Deprecation Warning fail-closed compileall and diff check: PASS

    Together with registry and base-weight repairs, #421 residual is now 21/24. Full exact-head provenance, hosted gates and independent approval remain outstanding, so the PR stays Draft and the issue stays open.

  6. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    #421 calibration-adjustment supersession sibling at exact head 5779384da2cbdb7b325ff851963c2407301f851d

    Source-first f4606c914832c226aa0c26cbebd4c9b9c889d1cc adds a hostile regression proving that CalibrationAdjustmentSupersessionAuthorityView remains forgeable while _CALIBRATION_ADJUSTMENT_SUPERSESSION_VIEW_ISSUANCE_MARKER is importable: a caller can allocate the exact runtime object, fill the declared inert slots and copy the module marker.

    Ordinary child 5779384da2cbdb7b325ff851963c2407301f851d removes that module-global capability. Existing purpose authorization, static read-capability validation, canonical owner reconstruction/equality, exact coordinate checks and effective-time currentness stay in _resolve_calibration_adjustment_supersession_authority_state(...). _build_calibration_adjustment_supersession_view_runtime() owns the closure-private seal; the public resolver receives only inert authorized state, writes the private seal last and remains the sole issuance path. Raw caller-owned exact objects therefore stay unreadable even when all known slots are populated.

    The commit diff is limited to the expected seal removal, _require_issued delegation, state extraction and closure-private runtime construction. Current exact-head Foundation/Security/SAST/CodeQL runs are queued, so no hosted or broad-suite GREEN is claimed yet.

    #421 residual is now 20/24 public-view owner modules. The issue remains open.

  7. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    #421 nonresponse supersession sibling at exact head 7fae1d0342633c715dbd3e336637a86f802facef

    Source-first 025c5ac08c0c5955c6c8e0fe63e6506800f6225c adds the hostile marker-copy regression for NonresponseAdjustmentSupersessionAuthorityView: the predecessor exposes _NONRESPONSE_ADJUSTMENT_SUPERSESSION_VIEW_ISSUANCE_MARKER, so caller code can allocate the exact runtime view, populate its slots, copy the module marker, and pass _require_issued().

    Ordinary child 7fae1d0342633c715dbd3e336637a86f802facef removes that importable write capability. Existing purpose authorization, static read-port validation, canonical owner reconstruction/equality, requested-coordinate matching and effective-time currentness remain in _resolve_nonresponse_adjustment_supersession_authority_state(...); the public resolver receives inert authorized state and writes the closure-private seal last.

    Commit diff inspection shows only the expected seal removal, verifier delegation, state extraction and closure-private runtime construction. Current exact-head hosted gates are not yet terminal, so no broad or hosted GREEN is claimed.

    #421 residual is now 19/24 public-view owner modules. The issue remains open.

  8. seonghobae
    added a commit that references this issue on Sep 19, 2026

    fix(workforce-validation): hide calibration adjustment seal

    77ed659

  9. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Current ordinary-forward handoff: PR #235 head is 4276ae996ee2bd81687684c0602c7b0763805378.

    This run added closure-private seals for CalibrationAdjustmentAuthorityView (77ed6598...), CalibrationAuxiliaryAuthorityView (ba878fe9...), and CalibrationBenchmarkAuthorityView (4276ae99...). Focused results were 111/111, 79/79, and 66/66 respectively, with each owned module at 100% statement/branch coverage plus compile/diff checks.

    Systematic census: 8/24 repaired, 16/24 residual. Keep #421 open until residual zero and final exact-head broad/hosted acceptance, independent approval, and normal protected integration.

  10. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Added CalibrationSupportAuthorityView closure-private repair at 4ae6a9489fac4a60e6f34925bfab86eda14578f0.

    Focused evidence: 74/74, 247/247 statements, 46/46 branches, compile/diff PASS. Census is now 9/24 repaired, 15/24 residual; Issue remains open.

  11. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Exact-head verification for 8ef4eb4abe72d8942d001609123d5b798a36c2c0:

    • Remote blobs for both repaired source files, both RED contracts, CHANGELOG and manifest.json are byte-identical to the isolated verification tree.
    • Combined focused suite: 212/212 tests.
    • Owned production coverage: 624/624 statements, 148/148 branches, 100% across final_weight_authority.py, final_weight_component_binding_authority.py and the concurrently repaired final_weight_supersession_authority.py.
    • Foundation repository validation and Node foundation contracts: 23/23.
    • Deprecation Warning fail-closed compileall and git diff --check: PASS.

    #421 remains 12/24 residual. Full service, wheel-build, PostgreSQL and hosted security/model-review gates remain outstanding and are not inferred from this focused evidence.

  12. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Exact-head security evidence — 906361bddf4b2fa0528cc273e910599b3a1c02e3

    • ValidationResultAuthorityView: RED 35b8420522d605cad0ee9857f66e09e5603d5eab → GREEN 99ef4c06c9f3fb3ba0787abd229fd797e67640cb; focused 20/20, 186/186 statements, 30/30 branches.
    • ValidationResultNonVerifiabilityView: RED a417e7cbe4062b145c24a56ee657c0d3a9df88a6 → GREEN 484bfe609ef3998150950acfb9ccda5ca8a87107; focused 50/50, 238/238 statements, 54/54 branches.
    • Concurrent NonresponseAdjustmentAuthorityView repair independently verified: 67/67, 214/214 statements, 32/32 branches.
    • Combined exact-source selection: 85/85. Service-wide source run: 1,420 passed; expected blockers are the next security(workforce-validation): remove module-exposed authorized-view sealing capabilities #421 residual marker and two pinned-setuptools wheel tests unavailable in this local environment.
    • Combined repaired-module coverage: 638/638 statements, 116/116 branches, 100%. Repository validation, Foundation 23/23, Deprecation-Warning fail-closed compileall and diff check passed.
    • CHANGELOG and deterministic manifest resealed in 906361bddf4b2fa0528cc273e910599b3a1c02e3.

    #421 remains open at 15/24 repaired and 9/24 residual. Draft/Proposed and hosted exact-head gates remain authoritative; no broad hosted GREEN, merge, release, or predecessor-verdict transfer is claimed.

  13. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Exact-head trimming-view evidence — fccb76ecd1e4edf0053d9d33e81e6625c46725a4

    • TrimmingBoundingAuthorityView: RED d5ae65ee959bfe5c4485dd42e3837ae226802494 → GREEN 4fb57705278337e79090f8781691b474a05c09c7.
    • Importable _TRIMMING_BOUNDING_VIEW_ISSUANCE_MARKER was removed; closure-private issuance retains purpose authorization, owner read/canonical reconstruction, requested-coordinate equality, release/currentness, field minimization and marker-last issuance.
    • Focused exact-source verification: 55/55 tests, 187/187 statements, 30/30 branches, 100%; Deprecation-Warning fail-closed compileall and diff check passed.
    • Package-wide census now advances to the next residual TrimmingBoundingSupersessionAuthorityView, so security(workforce-validation): remove module-exposed authorized-view sealing capabilities #421 is 16/24 repaired and 8/24 residual.
    • CHANGELOG and deterministic manifest were resealed; repository validation and Foundation 23/23 passed.

    Draft/Proposed remains correct. Hosted current-head gates, independent approval, residual completion and installed-wheel acceptance remain outstanding.

  14. seonghobae commented on Sep 19, 2026

    @seonghobae
    seonghobae
    on Sep 19, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    #421 source residual is 0/24 on exact #235 head 89b1334c1a036437ae1f0e37a7058fca8f7aeb82.

    Independent acceptance now passes 1,440/1,440 service and built-wheel tests with pinned setuptools==82.0.1, 5,188/5,188 statements and 1,116/1,116 branches (100%), Foundation 23/23, repository/manifest validation, warnings-as-errors compileall and diff check. The issue remains open because hosted gates, PostgreSQL owner-schema evidence, qualifying independent approval and normal protected integration are still outstanding.

    Exact-head PR evidence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingpriority: high

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions