If a CompoundFormField is defined in a Form (with an associated Schema for validation), it is possible for a crafted url (or form entry) to bypass validation. If the url does not include the widget at all, validation does not appear to occur unless there is a specific reference to the widget in the parameters for the target (validating) controller.
Furthermore, the widget parameter must have a default value of a dict in order for validation to always work. If the widget parameter has a default value of None (or no default value), then if the widget is missing from the url, validation will pass.
Attached are two files. One is a test project where the /index controller has a link that demonstrates good and bad behavior. The second is a patch to the turbogears 1.0 branch that contains tests showing the behavior in a bit more detail.
Some discussion about the issue
