fix(people): protect governed mutation runtime types - #64
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughPeople 변이와 채용 수락 경계가 서브클래스를 거부하도록 변경되었습니다. UUID, 문자열, Decimal, 명령, 결과, 권한 결정, 시간값, PostgreSQL 행 형태에 정확한 타입 검사를 적용했습니다. 런타임 무결성 회귀 테스트와 변경 기록을 갱신했습니다. ChangesPeople 런타임 무결성
Estimated code review effort: 3 (Moderate) | ~25 minutes Merge Risk: ⚪ Minimal · up to This change hardens People mutation and hire-acceptance inputs against executable subtype values while preserving supported built-in values and persistence behavior. No concrete current-head merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
changed the title
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head repair/evidence update for the current branch state:
Fresh exact-current-head hosted evidence is terminal GREEN: People API Quality Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Current exact-head follow-up after fresh review: A new review correctly identified that the three direct
Fresh exact-current-head hosted evidence is terminal GREEN:
Live protected base remains |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@opencode-agent Please review the current unchanged head against protected |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@coderabbitai review Please review exact head |
|
|
|
Adjacent-owner freshness update: #65 advanced non-force to exact head |
|
Adjacent-owner successor update: #65 is now exact head |
|
@coderabbitai review Please review exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/Orgmetra"
head="d9cc516d54b4642f59fe126c331a19945fdf75f1"
echo '== Exact revision and pull request state =='
printf 'checked_out='; git rev-parse HEAD
git cat-file -e "${head}^{commit}"
gh pr view 64 --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefName,baseRefOid,mergeable,url
echo '== Exact-head scope and whitespace =='
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git diff-tree --no-commit-id --name-status -r "$head"
git diff --check "${head}^" "$head"
git diff --stat "${head}^" "$head"
git diff --unified=160 "${head}^" "$head"
echo '== Locate canonical documents, API surface, traceability, and manifest =='
fd -t f . docs services database schemas \
| rg -i '(^|/)(api_contract|data_model|erd|uml|prd|trd|changelog|manifest|openapi|employment-separation|0015).*|separation.*employment|employment.*separation' \
| sort
echo '== Canonical documentation and changed-file contents =='
for file in $(git diff --name-only "${head}^" "$head"); do
case "$file" in
*.md|*.yaml|*.yml|*.json)
echo "== $file =="
cat -n "$file"
;;
esac
done
echo '== Production separation contract and published authorization-header contract =='
rg -n -C 14 -i \
'(separate_employment|employment.separation|employment separation|separation_reason_code|voluntary_resignation|retirement_transition|fixed_term_completion|position_elimination|employer_initiated_separation|authorization|authorization-header|x-.*authorization|bearer|header)' \
services/people-api/src services/people-api/openapi schemas database/migrations docs \
-g '*.py' -g '*.yaml' -g '*.yml' -g '*.sql' -g '*.md' 2>/dev/null || true
echo '== Rehire, hosted PostgreSQL acceptance, and Foundation claims in canonical docs =='
rg -n -C 10 -i \
'(rehire|formerworker|rehirecandidate|hosted.*postgres|postgres.*acceptance|foundation|implemented|shipped|awaiting|planned|`#311`)' \
docs CHANGELOG.md \
-g '*.md' 2>/dev/null || true
echo '== Manifest validation and deterministic inventory =='
python3 - <<'PY'
import hashlib
import json
from pathlib import Path
manifest = json.loads(Path("manifest.json").read_text())
entries = manifest.get("files", [])
print(f"manifest_entries={len(entries)}")
for entry in entries:
path = entry.get("path")
if path in {
"CHANGELOG.md",
"docs/API_CONTRACT.md",
"docs/DATA_MODEL.md",
"docs/ERD.md",
"docs/UML.md",
"docs/PRD.md",
"docs/TRD.md",
"docs/traceability/employment-separation.md",
"docs/adr/0015-governed-employment-separation-transition.md",
}:
p = Path(path)
actual = hashlib.sha256(p.read_bytes()).hexdigest() if p.exists() else None
print(json.dumps({
"path": path,
"manifest_sha256": entry.get("sha256"),
"actual_sha256": actual,
"manifest_bytes": entry.get("bytes"),
"actual_bytes": p.stat().st_size if p.exists() else None,
"manifest_lines": entry.get("lines"),
"actual_lines": len(p.read_text().splitlines()) if p.exists() else None,
}, sort_keys=True))
PY
echo '== CHANGELOG provenance delta and history =='
git diff --unified=100 "${head}^" "$head" -- CHANGELOG.md manifest.json
rg -n -C 8 -i \
'(employment separation|separation|provenance|authorization|rehire|postgresql|foundation)' \
CHANGELOG.md
echo '== Exact-head checks and reviews =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | "\(.name)\t\(.status)\t\(.conclusion // "null")\t\(.details_url)"' || true
gh pr view 64 --repo "$repo" --json reviews \
--jq '.reviews[] | "\(.author.login)\t\(.state)\t\(.commit.oid)"' || trueLength of output: 204272 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="d9cc516d54b4642f59fe126c331a19945fdf75f1"
echo '== Revision and changed paths =='
git rev-parse HEAD
git show --no-patch --format='commit %H%nparents %P%nsubject %s' "$head"
git diff-tree --no-commit-id --name-status -r "$head"
echo '== Cumulative paths from documented predecessor =='
git diff --name-status "1a094cbe78422a9c31812620c1b17484059dc123" "$head"
echo '== Exact head diff by target document =='
git diff --unified=80 "${head}^" "$head" -- \
docs/API_CONTRACT.md docs/DATA_MODEL.md docs/ERD.md docs/UML.md docs/PRD.md docs/TRD.md \
docs/traceability/employment-separation.md CHANGELOG.md manifest.json schemas/openapi.yaml
echo '== Authorization headers: OpenAPI operation vs canonical API contract =='
rg -n -A100 -B15 \
'(/v1/employment-separations|EmploymentSeparation|employment-separation)' \
schemas/openapi.yaml docs/API_CONTRACT.md docs/SECURITY.md \
-g '*.yaml' -g '*.md'
rg -n -C 5 \
'(X-Tenant-Reference|X-Actor-Reference|X-Purpose-Code|Authorization|Idempotency-Key)' \
schemas/openapi.yaml docs/API_CONTRACT.md docs/SECURITY.md \
-g '*.yaml' -g '*.md'
echo '== Explicit manifest entry names and exact-manifest completeness =='
jq -r '.files[].path' manifest.json | sort
echo '== canonical docs absent from manifest =='
for p in \
docs/API_CONTRACT.md docs/DATA_MODEL.md docs/ERD.md docs/UML.md docs/PRD.md docs/TRD.md \
docs/traceability/employment-separation.md docs/adr/0015-governed-employment-separation-transition.md \
schemas/openapi.yaml CHANGELOG.md; do
jq -e --arg p "$p" '.files[] | select(.path == $p)' manifest.json >/dev/null \
&& echo "present $p" || echo "absent $p"
done
echo '== Canonical docs final separation sections =='
for p in docs/API_CONTRACT.md docs/DATA_MODEL.md docs/ERD.md docs/UML.md docs/PRD.md docs/TRD.md; do
echo "== $p =="
rg -n -C 8 -i \
'(employment.separation|employment separation|separation_reason_code|rehire|authorization|header|`#311`|hosted|postgresql)' "$p" || true
done
echo '== Changelog exact new active-PR entry and protected provenance =='
sed -n '1,90p' CHANGELOG.mdLength of output: 123713
Medium — State the required authorization headers for Employment separation in the canonical API contract.
However, Add Employment separation to the shared-header statement, or state the four required headers directly in the Employment-separation section. This change keeps the canonical document aligned with the published OpenAPI operation and prevents a client from treating the route as requiring only body-level tenant, actor, and purpose data. The docs otherwise reconcile the separation model correctly. They define the five controlled reason values, mark rehire I treated You are interacting with an AI system. |
|
Descendant performance receipt currentized: #317 is now exact |
|
Fresh required-workflow/current-authority receipt for exact #64 head Strix Descendant #317 remains Draft/open/mergeable on this exact #64 base at |
|
Descendant performance authority update only; #64 source head remains unchanged at #317 has advanced ordinary-forward to exact This does not change People production semantics and does not create buyer-performance evidence. No hosted exact-head k6 execution or measured p50/p95/p99/max is claimed; #316 remains open. #64 remains Draft and this descendant evidence does not alter its central Dependency Review/CodeQL or independent-approval boundaries. |
|
Descendant authority follow-up: #317 is now exact |
|
Descendant authority follow-up only; #64 source remains exact |
|
Descendant authority update for the active People owner: stacked performance PR #317 is now exact This does not alter People production semantics or #64 gate evidence and is not buyer-performance GREEN. Exact #317 still has no hosted check run or production-equivalent k6 p50/p95/p99/max evidence. |
|
Descendant authority update: stacked performance PR #317 is now exact This changes only performance-evidence mechanics. It does not alter People production semantics, #64 gate evidence, or establish buyer-performance GREEN. |
|
Descendant authority update: performance PR #317 is now exact A fresh CodeRabbit P1 invalidated #317's predecessor claim that a locally emitted result digest was a durable handoff: a caller could replace result bytes, recompute the digest, and construct matching runtime evidence. #317 now fails commercial acceptance closed before local result/runtime/fixture/digest evidence can become a receipt, and the benchmark digest is explicitly structural evidence only. Central authenticated owner path This changes only descendant performance-evidence mechanics. It does not change Employment separation semantics or any #64 gate result, and it establishes no p95 GREEN. |
|
Descendant performance authority currentization: #317 is now exact CodeRabbit found a second commercial-evidence P1 on #317 predecessor Central positive authority remains |
|
Descendant/central authority receipt update: #317 itself remains exact |
1 participant
Current execution receipt — 2026-09-13
c0ba482c57a77820128f259b4a43c06df643c0f3; protected base:develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f; open, Draft, mechanically mergeable. Mechanical mergeability is not merge authorization.f4f7e12d5edd253203c237d3a46703ca7449a8bapins both SECURITY DEFINER pgcrypto calls topublic.digest(...);71d72267be22d3368517a8171b61321592bfb958extends the PostgreSQL capability contract for database ownership/schema-CREATE/tenant-GUC boundaries;120616b1de33c1ff5c0de09dceb77dfea06691b9states that the tenant session GUC is a routing/RLS input established only after Keyverse-authenticated People-service tenant/actor binding, not an authentication factor.120616b1...: manifest validation reported exact mismatches for migration 0014, THREAT_MODEL, and the capability PostgreSQL contract.c0ba482...reseals only those exact fingerprints; no provenance path was excluded or weakened.34747271197: SUCCESS on exactc0ba482..., including repository/provenance validation, OpenAPI contracts, owned Python/service tests at 100% statement and branch coverage, the workflow's isolated PostgreSQL contract set, and final clean/read-only validation. Recovery34747271200: SUCCESS. SAST34747271263: SUCCESS. Dynamic Code Quality34747211676: SUCCESS. Required OpenCode34747212198: SUCCESS. Required Noema34747212207: SUCCESS on this exact head.34747212212: SUCCESS on exactc0ba482.... Thestrixjob103697332156completedRun Strix (quick), report collection, and artifact upload successfully. The report's security result contains zero SARIF findings and states no vulnerabilities were identified in the provided People source slice. Its separate note that Job Analysis Snapshot endpoints were not implemented is not an Orgmetra product gap: protecteddevelopcontainsservices/job-analysis-api/src/orgmetra_job_analysis_api/http.pyplus route tests for the documented POST/GET endpoints. Treat that note as scope incompleteness of the People-only scan, not a repair finding.test_employment_separation_capability_postgres.shnor all newer separation companions. The changed contract is provenance-required and source-reviewed, but its new database-owner/no-CREATE/GUC-mismatch assertions are not claimed hosted GREEN from Foundation. ci: make PostgreSQL Foundation discovery fail closed #311 remains the canonical generic protected-base PostgreSQL discovery/execution owner.34747271228: FAILURE only at authoritative Dependency Review availability. Exact protected-base→head support probe returned HTTP 403 (curl_exit=0); OSV, Trivy, and Scorecard are SUCCESS but are not substitutes. Fresh exact canary is recorded at central.github#810; no Orgmetra-local fallback or synthetic verdict.34747271161: FAILURE in the shared producer-after-consumer settlement path, not a demonstrated Orgmetra source/SARIF finding. Actions job103697626932and Python job103697626984settled withVERDICT_STATE=pending; the coordinator/producer job103698066725did not start until after those consumers failed and then dispatched successfully. Fresh exact consumer evidence is recorded on canonical central #2040; prerequisite #2106 remains the bootstrap owner. No predecessor verdict transfer, no-op retrigger, synthetic status, or product-local workflow copy.APPROVEDreview has been established. Keep Draft.Employment separation contract
The active branch owns governed
POST /v1/employment-separationswith exact current-known Employment/version targeting, five controlled reasons (voluntary_resignation,retirement_transition,fixed_term_completion,position_elimination,employer_initiated_separation), human-confirmed versioned evidence, bitemporal supersession instead of in-place termination, append-onlyemployment_separation_record, atomic People idempotency + audit/outbox, capability-separated PostgreSQL execution, and shared Employment-anchor serialization with Assignment creation.Durable invariants:
effective_tois structural interval closure; the terminalterminatedversion plusemployment_separation_recordis the authoritative separation fact;candidate_worker_conversion_recordis recruiting provenance, not generic Employment/Assignment authorization and not rehire authority;Remaining owner paths / buyer gaps
docs/product-technical-gap-baseline.md; this PR does not compete on that file.9b1b116f0d937bee0afcc6646b140edd09f11d8a, basec0ba482.... Its latest repair removes cardinality-based load-profile inference: RED172f7575416883aa3b9aae4c9b219059399e279fproves omitted profile identity was accepted on the predecessor,37e40ae694c46221eab76fd495cd6d0a4c0c3fdcrequires explicit profile identity in the load-model validator, and9b1b116...binds both result and independently observed runtime load evidence to that selected profile. Source-equivalent focused run-contract validation is 9/9 PASS; this is not hosted CI or buyer-performance evidence. The commercial entry point remains fail closed on central.github#2162; mutable Draft.github#2164/#2166heads are not consumed. No hosted exact-head k6 run or measured p50/p95/p99/max is claimed; real acceptance still requires exact-candidate ASGI composition, sanctioned Keyverse/auth, production-equivalent PostgreSQL/pool settings, right-cleared prepared records, pinned k6, an independent runtime/load observer, cleanup/resource evidence, and immutable authenticated performance attestation..github#810; central CodeQL consumer/producer settlement remains #2040 with protected-handler prerequisite #2106. Product-local copies/workarounds are prohibited.No self-approval, routine administrator bypass, force-push, destructive rebase, gate weakening, predecessor-evidence transfer, synthetic status, direct-provider fallback, or premature merge/release is authorized by this PR.