fix(multilevel): reject hostile numeric conversion hooks

CHANGELOG.md

@@ -552,6 +552,12 @@
   vocabulary and mark parallel-analysis control bounds and essay-report native
   dark-mode accents as ancestral after their integration.
 
+#### Multilevel hostile numeric callback rejection
+
+- Multilevel membership weights and AR(1) coefficients now admit only exact
+  built-in `int`/`float` scalars, rejecting booleans and caller-defined
+  conversion hooks before contract arithmetic.
+
 #### Diagnostics-report focus and contrast preservation
 
 - Revealed the visually hidden diagnostics-report skip link for every actual `:focus` state while retaining the explicit `:focus-visible` treatment and strong outline.

docs/changelog.d/785-multilevel-hostile-numeric-callbacks.md

@@ -0,0 +1,7 @@
+# Multilevel hostile numeric callback rejection
+
+## Fixed
+
+- Multilevel membership weights and AR(1) coefficients now admit only exact
+  built-in `int`/`float` scalars, rejecting booleans and caller-defined
+  conversion hooks before contract arithmetic.

python/fast_mlsirm/multilevel/_validation.py

@@ -114,7 +114,7 @@ def exact_integer(
 
 def membership_weight(value: Any) -> float:
     """Return one finite membership weight in the interval ``(0, 1]``."""
-    if isinstance(value, bool) or not isinstance(value, (int, float)):
+    if type(value) not in (int, float):
         raise contract_error(
             "invalid_membership_weight",
             "$.membership_weight",
@@ -132,7 +132,7 @@ def membership_weight(value: Any) -> float:
 
 def autoregressive_coefficient(value: Any) -> float:
     """Return one finite stationary AR(1) coefficient strictly inside unity."""
-    if isinstance(value, bool) or not isinstance(value, (int, float)):
+    if type(value) not in (int, float):
         raise contract_error(
             "invalid_autoregressive_coefficient",
             "$.autoregressive_coefficient",

tests/test_multilevel_hostile_numeric_callbacks.py

@@ -0,0 +1,53 @@
+"""Hostile numeric callback boundaries for multilevel contracts."""
+
+from __future__ import annotations
+
+import pytest
+
+from fast_mlsirm.multilevel import (
+    LongitudinalStateKind,
+    MultilevelContractError,
+    build_context_membership,
+    build_longitudinal_state_spec,
+)
+
+
+class ExplosiveFloat(float):
+    """Float subclass that exposes whether validation dispatches callbacks."""
+
+    def __float__(self) -> float:
+        """Raise an attacker-controlled exception instead of coercing."""
+        raise RuntimeError("sensitive_numeric_callback")
+
+
+def test_membership_weight_rejects_numeric_subclass_without_callback() -> None:
+    """Membership validation fails closed before untrusted numeric coercion."""
+    value = ExplosiveFloat(1.0)
+
+    with pytest.raises(MultilevelContractError) as caught:
+        build_context_membership(
+            observation_id="observation_alpha",
+            context_dimension_id="school_context",
+            context_id="school_north",
+            membership_weight=value,
+            membership_revision_fingerprint="a" * 64,
+        )
+
+    assert caught.value.code == "invalid_membership_weight"
+    assert caught.value.path == "$.membership_weight"
+    assert "sensitive_numeric_callback" not in str(caught.value)
+
+
+def test_autoregressive_coefficient_rejects_numeric_subclass_without_callback() -> None:
+    """AR-state validation fails closed before untrusted numeric coercion."""
+    value = ExplosiveFloat(0.5)
+
+    with pytest.raises(MultilevelContractError) as caught:
+        build_longitudinal_state_spec(
+            state_kind=LongitudinalStateKind.STATIONARY_AUTOREGRESSIVE,
+            autoregressive_coefficient=value,
+        )
+
+    assert caught.value.code == "invalid_autoregressive_coefficient"
+    assert caught.value.path == "$.autoregressive_coefficient"
+    assert "sensitive_numeric_callback" not in str(caught.value)