security(workforce-validation): hide component-resolution sealing authority from module consumers #422

Finding

Fresh #421 census review exposed the same module-capability defect in the proof-bearing FinalWeightComponentEvidenceResolution, which is not one of the 24 public *View classes and therefore has its own repair lane.

At canonical #235 predecessor d5d847e1baa7142f0ed5422aad777be44424fd0f, final_weight_component_evidence_resolution.py defines module-global _RESOLUTION_ISSUANCE_MARKER = object(). FinalWeightComponentEvidenceResolution._require_issued() accepts that exact object and _issue_component_evidence_resolution(...) writes it into the private issuance slot. Ordinary consumer code can import the module marker, allocate object.__new__(FinalWeightComponentEvidenceResolution), populate the mangled base/adjustment slots plus the real marker through object.__setattr__, and make the proof-bearing base_weight / adjustments properties pass without corroborate_final_weight_component_evidence(...).

This is an additive refinement of #413/#415. Their valid repairs removed ordinary construction, tuple-base construction, unsealed raw allocation, and public mutation, but an importable module seal remains an alternate proof issuer. Do not close or roll back those predecessor repairs.

Source-first RED

a27f50d12ccca27ca3b6c0e4a184fc32e1a31888 extends the existing issuance-integrity suite with two explicit contracts:

• the module must not expose _RESOLUTION_ISSUANCE_MARKER;
• a caller that allocates an exact result object, inserts canonical base evidence, an immutable empty adjustment tuple, and any marker obtainable from module state must still receive FinalWeightComponentEvidenceIntegrityError from both proof properties.

The current production source fails these contracts by construction. This is source-established RED only; no hosted failure has run yet.

Required repair

Move resolution issuance authority to closure-private state or an equivalent boundary exposing only verification, while removing the module-level unconditional _issue_component_evidence_resolution(...) minting capability from ordinary consumers. Keep canonical component reconstruction and immutable adjustment validation inside the governed corroboration path. Preserve purpose authorization before every owner read, authoritative final-weight/binding re-resolution, field minimization, scope/currentness and exact final-receipt audit correlation from #411–#418.

The boundary is ordinary in-process product code, not cryptographic resistance against arbitrary interpreter-memory/reflection attacks.

Current evidence boundary

Source repair remains in exact #235 head 731b5e9605f0d4d8f27e45920c68b73da2d44be0. Independent exact-tree verification passes 1,441/1,441 service and built-wheel tests, 5,186/5,186 statements and 1,116/1,116 branches (100%), Foundation 23/23, repository/manifest validation, warnings-as-errors compileall and diff check. PostgreSQL owner-schema, hosted security/model-review verdicts and independent approval remain outstanding.

Completion boundary

Keep open through source repair, exact-head 100% owned statement/branch/docstring/edge evidence, pinned installed-wheel and PostgreSQL acceptance, central Foundation/Security/SAST/CodeQL/model review, qualifying independent approval, normal protected #235 integration and durable #248 adoption of the canonical corroboration API rather than type/seal assertions.