feat(ui): add one-time HR export delivery confirmation states

[seonghobae]

Buyer-visible interaction gap

The active HR Workspace stack has shared protected-read states in #130, while the governed export owner stack #75 → #120 defines high-risk human review and at-most-once one-time delivery semantics. This dependency-first Orgmetra-only child adds the workflow-specific export interaction proof without creating another export backend, changing HR data, or mutating a dedicated-writer dependency.

The UI makes the safe next action explicit across the consequential export lifecycle: explicit high-risk confirmation before any delivery attempt; one confirmed-ready handoff state; busy/disabled duplicate-send prevention while publishing; read-only receipt handling after successful delivery; a fail-closed indeterminate state that says do not send again; reconcile the existing delivery reference; and actionable purpose/authorization denial. Component-state evidence carries no protected HR values, identifiers, destination addresses, credentials, compensation, ratings, or model output.

Design authority and dependencies

• Technical parent/base: feat(ui): add accessible protected-read request states #130 feat/hr-workspace-protected-read-state@b3b30058a79174000919d566fbbb1fdad80c62bf.
• Parent feat(ui): add accessible protected-read request states #130 itself depends on feat: add evidence-centered HR workspace slice #53 and owns the shared loading/disabled/error/read-only/focus semantics and existing Orgmetra design tokens.
• Figma Orgmetra Baseline file xu1ZK1zmtFcDep95R8oE9O, Storybook Inventory node 1:64, was re-read without mutation. It explicitly requires default / hover / focus / disabled / loading / validation-error / read-only / high-risk-confirmation states. This child consumes that published requirement and adds no competing Figma geometry.
• Semantic backend owners remain feat(privacy): add governed HR data export review control #75 (governed export review) and feat(privacy): execute audited one-time HR export egress #120 (audited one-time delivery with reconciliation-only ambiguity handling). Their checks/reviews do not transfer here and no unmerged backend package is imported.

RED → root-cause implementation

• RED contract 90486b897f39ffc6aa560087808651a12db9bd0f defined one-time export review/publishing/delivered/indeterminate/denied behavior before production/story artifacts existed.
• Workflow 30351aed0b59839255d21dc6cfdd50eb481cf429 materialized the exact-head quality gate. Hosted run 33070326964, job 98510595941, acquired a runner, checked out the exact SHA, proved the checkout, set up Node, and then failed at Run one-time export interaction contract with exact coverage. This is a genuine terminal RED at the missing owner implementation boundary; clean-checkout was skipped only because the contract step failed.
• Regression strengthening 293c0d88b8768bb685e6d1fccd83d0bceeb1edd7 adds the distinct ready state so UI confirmation cannot itself masquerade as backend authorization: confirmation becomes locked, exactly one delivery handoff is enabled, and the copy explicitly says the backend must still revalidate authority.
• Root implementation 9df1f8f6a9e86c065967cec0b1756d214dbdee1b adds exact-state, value-minimized interaction semantics and static Figma-correlated markup.
• Storybook 605dc18c9b2b415f578b58803d3d6ff32e5c026f provides ReviewRequired, ConfirmedReady, Publishing, DeliveredReadOnly, DeliveryIndeterminate, and PermissionDenied evidence.
• Tokenized/focus-visible styling 9c6b619b4fb537ee57bc7c8ec0ceb16af001ad5c reuses the existing Orgmetra design system and keeps denied/indeterminate behavior perceptible without relying on color alone.
• Doctoring 332c24ce05eca2d5b5efd95ad2e3741036e0e229 records the Figma authority plus final W3C WCAG 2.2 / WAI-ARIA 1.2 primary references without claiming conformance.
• Current head 8cfeb21f2bad73a9c7a4a60b1b7597e4779f429e adds dedicated traceability for the technical and semantic dependency boundaries, privacy minimization, no-republish ambiguity rule, and post-parent revalidation requirements.

Exact-current-head evidence

Parent/base: #130 b3b30058a79174000919d566fbbb1fdad80c62bf.
Child head: 8cfeb21f2bad73a9c7a4a60b1b7597e4779f429e.
GitHub reports open · Draft · mergeable.

HR Workspace Export Delivery State Quality run 33070554785, job 98511379714, is terminal GREEN. The job checked out and asserted the exact child SHA, ran the one-time export interaction contract under Node 24 with exact 100% line / branch / function coverage thresholds, and passed clean-checkout.

Fresh submitted reviews: none. Fresh review threads: none.

This is focused stack-local GREEN only. Parent #130 checks/reviews never transfer; #75/#120 backend evidence never transfers; and the child does not claim default-branch integration or production export authorization.

Stack / merge discipline

Keep Draft. Process #53 → #130 first. Before this interaction can be represented as commercially available product truth, the relevant export backend owner contracts must also be integrated or consumed through their then-current published boundary. After parent integration, retarget/reconcile against fresh develop, refetch #75/#120 contract truth, and rerun every applicable browser/accessibility/Foundation/SAST/Security/Recovery/central workflow on one resulting exact head.

Do not transfer parent/backend evidence, self-approve, use routine administrator bypass, race another lifecycle writer, weaken a gate, republish after an indeterminate delivery, or mutate another CWL repository.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}