feat: add governed performance review packet - #44
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough
Changes성과 검토 증거 패킷
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟡 Moderate · up to The governed performance review packet and digest validation pass the supplied package and security checks, but the PR is not merge-ready because the required Strix check has not produced a terminal successful result and qualifying independent approval is missing. Sequence Diagram(s)sequenceDiagram
participant Builder as build_performance_review_packet
participant Packet as PerformanceReviewPacket
participant Export as canonical_json
participant Digest as sha256_digest
Builder->>Packet: 검증된 입력으로 패킷 생성
Packet->>Packet: UTC 시각 고정 및 HMAC 봉인 등록
Export->>Packet: 발행 봉인과 현재 페이로드 검증
Packet-->>Export: 검증된 canonical JSON 반환
Digest->>Export: canonical UTF-8 JSON 요청
Export-->>Digest: canonical JSON 반환
Digest-->>Builder: SHA-256 다이제스트 반환
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 57.89% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 76 functions across 7 files. (4 skipped: 4 unsupported.)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent Please independently review exact current head |
|
@opencode-agent Please independently review the current exact head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
1 participant
Buyer-visible outcome
Adds a governed, value-minimized performance-review evidence packet for accountable human review workflows. It correlates authoritative-lookup references for Person, Employment, Job, cycle, criteria, goals, criterion observations, optional development planning, reviewer, purpose/reason, evidence version, and business review period without carrying rating values, free-form feedback, or model-generated decision text. Independently supplied UUIDv4-shaped references are not treated as proof of opacity: until authoritative provenance resolves them, the packet conservatively records that direct person identifiers may be present and requires purpose-bound handling plus authoritative scope resolution before rating.
Latest Orgmetra-owned integrity repair
The newly verified defect was a seal-loss lifecycle reset. The prior single-use defense correctly rejected a second
__post_init__()while_PACKET_SEALS[id(packet)]still existed, but_PACKET_SEALSalso acted as the only "already issued" marker. If the process-local seal bytes were lost or discarded while the same packet remained live, a low-level caller could rewrite a field to another otherwise-valid value and invoke__post_init__()to install replacement evidence, minting a second canonical truth for one live packet identity.A realistic regression landed first on test-only head
721f13e7d432c1c96fb4aadd88226f1038891769. Performance Review Quality run33299443351, job99224652811checked out that exact head and failedtest_seal_loss_cannot_reset_live_issuance_lifecyclewith 1 failed / 87 passed andDID NOT RAISE ValueError, proving that seal loss reset issuance eligibility.The root repair on exact head
dbe465daad3c4ec60a2328046d09a93b1b9e67ecseparates current seal bytes from issuance lifecycle. A weak live-issued-identity registry records that the exact live packet has already issued even when current seal bytes are absent;_register_packet_seal()therefore fails closed on reinitialization of that same live object. Seal loss continues to make canonical export unavailable, but it no longer grants permission to issue again. Weak identity tracking releases with object lifetime rather than becoming durable process state. README, ADR 0018, traceability, package CHANGELOG, and regression tests describe the same boundary.This mechanism remains in-process mutation defense-in-depth only. It is not a hostile-interpreter capability boundary, portable/durable digital signature or attestation, distributed uniqueness service, authorization record, immutable audit/outbox, persistence proof, or rehydration credential.
Exact-current-head evidence
dbe465daad3c4ec60a2328046d09a93b1b9e67ecdevelop@9e3e4847510e1e612b48474ba42b177b8ed824df33299568467, job99224997471: terminal SUCCESS; exact checkout; 88/88 tests passed; owned package production 194/194 statements and 58/58 branches = 100.00%; compile and clean-checkout evidence are GREEN33299568500: terminal SUCCESS33299568464: terminal SUCCESS33299568495: terminal SUCCESS33299568489: OSV, Trivy, and Scorecard are GREEN, but dependency-review job99224997764is terminal FAILURE. Exact checkout succeeds; the exact dependency-graph comparison for base9e3e484…and headdbe465d…returns HTTP 403, so the pinned Dependency Review action is skipped and no dependency-review verdict exists. Existing dedicated-owner handoffContextualWisdomLab/.github#810owns that support/configuration boundary.33299567506, job99225037358: terminal FAILURE because no authenticatedopencode-agent/opencode-agent[bot]formalAPPROVEDorCHANGES_REQUESTEDreview exists for this exact head. The required check correctly refuses to stand in for the review. Existing owner handoffContextualWisdomLab/.github#624owns the review-plane boundary.33299567503, job99224995232: terminal FAILURE before an authoritative verdict. Trusted.github@359fc21c406f042190278f600cb2c8a522c445cdmaterialization, repository-scoped reviewer credential, public-target resolution, and 5/5 provider-secret checks succeed. The shared sidecar vendorscontextual-orchestrator@5f2753ace756ddd81049a5221d55e8977572a416, observes413 request_too_large, falls back to the live OpenRouter ZDR feed, starts locally, then exits before/healthzwithreview sidecar discovered no eligible models; the actual Noema review/verdict step is skipped. Existing owner handoffContextualWisdomLab/.github#1399already carries this current causal class and unchanged-head GREEN acceptance.33299567491, job99225287701: terminal FAILURE before actual vulnerability analysis. Trusted.github@359fc21c406f042190278f600cb2c8a522c445cdresolves the exact target/base, target token/visibility, required-workflow smoke, model policy, and 5/5 provider-secret gate; the shared sidecar vendorscontextual-orchestrator@5f2753ace756ddd81049a5221d55e8977572a416, receives413 request_too_large, falls back to the live OpenRouter ZDR endpoint feed, starts on127.0.0.1:18080, then exits status 1 before/healthzwithsidecar emitted an unexpected exceptionwhile 14 unstructured diagnostic lines are suppressed. Strix installation andRun Strix (quick)are skipped, so no authoritative vulnerability finding/no-finding exists. Diagnostic artifact9728572568(3,805 bytes), SHA-25690449eb0871452c347088cb33cc359b3128566ffa45cdefcedf78fb36ba4fd38, is diagnostic-only. Existing owner handoffContextualWisdomLab/.github#1327already carries this exact central bootstrap failure class and unchanged-head GREEN acceptance; the consumer does not duplicate that handoff.APPROVEDreview existsRemaining merge gates
This PR is not merge-ready. It remains Draft and must not merge until the unchanged exact head, or a fresh successor revalidated from zero, has terminal passing evidence for every applicable Orgmetra and central required gate—including Dependency Review/Security, OpenCode, Noema, and Strix—and qualifying independent non-author approval. Queued, pending, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, fallback-only, and model-only evidence is non-passing.
The remaining required-gate failures are foreign-owner control-plane/runtime boundaries. No Orgmetra shim, route override, no-op retrigger commit, gate weakening, predecessor evidence transfer, self-approval, routine administrator bypass, or foreign source/ref/workflow/settings mutation is permitted.
Scope / non-claims
This slice does not persist the authoritative final rating, free-form reviewer feedback, compensation action, Employment/Job records, or authoritative reference-resolution result. It does not autonomously determine a rating or employment action, and it does not replace accountable human confirmation. It does not claim that an immutable audit/outbox, external signing service, legal-compliance determination, certification, or commercial release is already deployed.