docs(talent): select candidate-document disposition and worker-record retention boundary

[seonghobae]

Selects the product/domain boundary requested by #303.

What

Adds the ADR slice (#303 deliverable 1) plus its cited reference note:

• docs/adr/0303-candidate-document-lifecycle-disposition.md — Context Map splitting four obligations: (1) non-selected applicant return/interim storage/destruction, (2) talent-pool enrollment as a separate purpose with its own lawful basis and expiry, (3) minimum materialization of accepted-candidate material into the worker/employment record, (4) post-separation statutory retention of the worker register and contract records.
• docs/doctoring/candidate-document-lifecycle-references.md — cited Korean authority (채용절차법 제3조·제11조 and 시행령 제2·3·4조; PIPA 제15·18·21조; 근로기준법 제42조 and 시행령 제22조) and the applied boundary.

Key decisions

• Ownership stays split: talent_acquisition (candidate/recruitment truth), people_core (worker/employment truth), document_records (artifact lifecycle). No cross-service application-table SQL.
• Return/deletion and talent-pool purpose are computed as separate states; a return-workflow exception is never read as a retention exemption.
• Applicability is an effective-dated, versioned policy keyed on tenant/employer size/jurisdiction — no global constants.
• Confirmed hire performs field/document-level purpose transition and minimum materialization, not whole-application re-classification.

Scope of this PR

Documentation only (no source, no manifest.json, no docs/adr/README.md). This is the ADR slice; PRD/TRD/DATA_MODEL/package code and policy execution remain follow-up work.

Exact-head authority

• protected base: develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f
• exact head: ddd76f85dc8063327a2c35d6bdf3e7a13181000d
• state: open · Ready for Review · mechanically mergeable; one commit / two documentation files
• Foundation CI 34582476741: SUCCESS; Repository quality 103209013400 is exact-head GREEN
• SAST 34582476764: SUCCESS; documentation-only scope is contract-valid
• Security 34582476771: SUCCESS for the documentation-only scope; dependency-review/OSV/Trivy/Scorecard/gitleaks are scope-valid skipped and are not misrepresented as scans of executable dependency changes
• required CodeQL 34582476748: SUCCESS; Python and Actions compatibility consumers are current-head GREEN, with the dispatch producer correctly skipped for this documentation-only scope
• repository CodeQL Analyze (Python / JavaScript-TypeScript) is also current-head SUCCESS
• coverage evidence/source-tree checks are SUCCESS
• Strix is scope-valid skipped for this documentation-only change; no scan-success claim is made from the skip
• Required Noema run 34582476704, job 103209324457: FAILURE in central model/provider availability, not an Orgmetra documentation finding. Exact-head admission, reviewer credential selection, repository-scoped App token, live-head validation, visibility resolution, and CO sidecar provisioning succeeded. Prepare Noema model verdict failed, publication was skipped, and the retained noema-sidecar-evidence artifact is id 10192644325, digest sha256:a00883245b2f3eebe8330e7134ab7d995777c832e26f88a01f600e6b90a80850. Artifact inspection shows free-pool degradation (24 candidates, 16 probed, only 2 ready against target 8, with 429/404/timeout pressure) followed by a gateway/provider-connectivity 502. Canonical central handoff: ContextualWisdomLab/.github#1948 comment 5632815766.
• OpenCode 103209668226 is current-head FAILURE only because the same-head Noema check was failed; its formal CHANGES_REQUESTED review reports no semantic source finding and explicitly points to Noema as the failed peer check.
• CodeRabbit did not provide a substantive review because its current OSS review capacity was rate-limited; do not treat that as approval or rejection.
• current inline review-thread inventory: zero

The two documentation files have deterministic current-head repository/CodeQL evidence and no verified semantic source finding. Do not churn this leaf branch to manufacture model availability. Normal merge remains fail-closed while the central Noema/OpenCode review governance is non-passing; no self/model approval, provider/model pin, paid fallback, no-op retrigger, predecessor verdict transfer, administrator bypass, force-push, or destructive rebase.

Refs #303.

[coderabbitai]

Warning

Review limit reached

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a52519c4-4819-464c-9048-c4b14e8364ae

📥 Commits

Reviewing files that changed from the base of the PR and between eb9757f and ddd76f8.

📒 Files selected for processing (2)

• docs/adr/0303-candidate-document-lifecycle-disposition.md
• docs/doctoring/candidate-document-lifecycle-references.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for ddd76f85dc8063327a2c35d6bdf3e7a13181000d.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Required Noema Review/noema-review: FAILURE (https://github.com/ContextualWisdomLab/Orgmetra/actions/runs/34582476704/job/103209324457)
• noema-review check run: failure (https://github.com/ContextualWisdomLab/Orgmetra/actions/runs/34582476704/job/103209324457)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Docs: 0303-candidate-document-lifecycle-disposition.md (2 files)"]
  S1 --> I1["operator or user guidance"]
  I1 --> R1["Review risk: Docs: 0303-candidate-document-lifecycle-disposition.md (2 files)"]
  R1 --> V1["docs review"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: ddd76f85dc8063327a2c35d6bdf3e7a13181000d
• Workflow run: 34582831142
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES
• Coverage gate: success
• Model pool: exhausted
• Verdict: REQUEST_CHANGES
• Formal review: docs(talent): select candidate-document disposition and worker-record retention boundary #306 (review)

[seonghobae]

Downstream implementation finding for ADR 0303: #307 currently implements only the transport/validation packet in Python. Under the repository language boundary, the ADR/TRD follow-up should record why this is an allowed validation-boundary use rather than policy/compute ownership, and an explicit removal/escalation condition: if candidate-document lifecycle evaluation becomes a material hot path, performs batch policy computation, cryptographic erasure orchestration, or other performance/security core work, move that compute to the Rust-first owner and keep Python as a thin validated transport boundary. Do not imply that the Python packet owns document_records execution or high-impact employment decisions. I am leaving #306 source unchanged here to avoid competing with its existing exact-head review lane; this is a repair requirement for the canonical documentation writer before/with downstream implementation acceptance.

[seonghobae]

ADR 0303 consumer audit found a concrete owner prerequisite now tracked as #308. #307 can currently express completed destruction states, but protected develop has no released/versioned document_records return/destruction completion-receipt contract. Since this ADR already assigns execution/completion receipts to document_records, #307 must not invent a leaf-local receipt schema or infer completion from return_delivered_at/statutory_retain_until. #308 owns immutable tenant-scoped completion receipt, idempotency/provenance/legal-hold policy evidence, and recovery-aware deletion across index/cache/replica/backup/restore. Please preserve that owner boundary when #306 is integrated; #307 remains Draft until #306 + package-neutral Foundation + #308 are protected/released and it can non-force adopt fresh develop.

[seonghobae]

Exact-head gate RCA for ddd76f85dc8063327a2c35d6bdf3e7a13181000d:

• Foundation 34582476741, SAST 34582476764, Security 34582476771, and CodeQL 34582476748 are all terminal GREEN.
• The remaining OpenCode CHANGES_REQUESTED is a gate-state finding caused by Required Noema Review run 34582476704, not a confirmed defect in the two documentation files.
• Exact Noema log shows the released contextual-orchestrator sidecar selected only orchestrator/free, completed health/provider preflight, then the gateway request ended after 356.1s with HTTP 502 (served_model=meta/muse-glimmer-30b). The workflow failed closed and published no review envelope.

No leaf source mutation, paid/provider override, manual rerun, or synthetic approval is warranted. Keep the current exact head unchanged; ordinary merge remains blocked until a qualifying exact-head independent review clears the request.