feat: add governed assignment change review packet

[seonghobae]

Buyer-visible outcome

Adds a governed pre-mutation assignment-change review packet that keeps Person, Employment, Assignment, Job, and Position identities separate; binds reviewed scope/allocation/policy/worker-impact/communication evidence; and preserves human-only approval before authoritative HRIS mutation.

Current integrity boundary

The packet uses process-local constructor-provenance and HMAC issuance evidence as in-process defense-in-depth only; it is not durable authorization, a portable signature, persisted cross-process uniqueness, or immutable audit/outbox evidence.

Current source closes the issuance paths exercised during this branch's review hardening. Normal AssignmentChangeReviewPacket(...) construction arms one context-local allocator ticket; the exact packet __new__() consumes that ticket immediately and binds constructor eligibility only to that exact live object. Direct object.__new__, direct packet-allocator calls, allocator calls reached reentrantly from caller-controlled timezone code, and subclass/factory attempts do not retain governed constructor provenance that can later be converted into a second issued packet. Successful construction then binds one canonical JSON snapshot to a process-local HMAC seal kept outside packet-writable slots and records the exact live identity as issued. Issuance registration is single-use, so a valid-value rewrite followed by __post_init__() cannot replace the authoritative seal. Canonical export requires the exact issued identity and verifies the same snapshotted bytes it returns.

The current README, ADR 0019, traceability, tests and package CHANGELOG are synchronized on this boundary. The controls intentionally do not claim a hostile-interpreter capability boundary, portable rehydration credential, durable authorization, or audit persistence.

Exact-current-head evidence

• exact head: 0023f13469cc0f6f9d1da08f3b1548062fa61dbe
• live base: develop@9e3e4847510e1e612b48474ba42b177b8ed824df
• state: open · Draft · mergeable
• Assignment Change Review Quality run 33295582915 / job 99214557479: terminal SUCCESS on this exact head; 108 tests passed, owned production 226/226 statements and 62/62 branches = 100.00% statement/branch coverage, compile and clean-checkout GREEN.
• Foundation CI run 33295582914: terminal SUCCESS.
• Recovery Rehearsal Quality run 33295582922: terminal SUCCESS.
• SAST Semgrep run 33295582964: terminal SUCCESS.
• Security Scan run 33295582942: Trivy, OSV and Scorecard are GREEN. Dependency Review job 99214557550 verifies checkout of this exact head, then fails closed in the central support probe because the public-repository dependency-graph comparison for base 9e3e484… → head 0023f134… returns HTTP 403 before the pinned Dependency Review action can execute. This remains owned by the existing ContextualWisdomLab/.github#810 handoff; no Orgmetra workaround is appropriate.
• Required OpenCode run 33295582127 / job 99214589148: required-workflow bootstrap/evidence jobs pass, but the gate finds no authenticated opencode-agent APPROVED/CHANGES_REQUESTED review bound to exact head 0023f134…, so it correctly fails closed. Existing owner path: ContextualWisdomLab/.github#624.
• Required Noema run 33295582187 / job 99214576078: trusted central source 6c8ee24046d743b3981c566c6e29f99f09137f6a, repository-scoped reviewer credential and target visibility resolve successfully. Shared contextual-orchestrator provisioning then reports endpoint-feed HTTP 413, selects the live OpenRouter ZDR feed, starts 127.0.0.1:18080, and exits before /healthz with review sidecar preflight failed; the actual Noema review/verdict step is skipped. Existing owner path: ContextualWisdomLab/.github#1399.
• Required Strix run 33295582098 / job 99214782315: exact target/base fetch, central workflow smoke test and provider-secret gate succeed. Shared sidecar provisioning reports the endpoint-feed HTTP 413, selects the live OpenRouter ZDR feed, then reaches /healthz and provider-route successfully. The subsequent gateway completion preflight times out after 30 seconds with curl exit 28 / zero bytes and gateway preflight request could not reach the local sidecar; Strix installation and the vulnerability scan are skipped. Diagnostic artifact 9727382738, SHA-256 e250802784294168783bf501f81519781fc524aca5402efb4716c9dca1faa579, is diagnostic-only and is not passing scan evidence. This distinct exact-head canary has been routed through existing owner path ContextualWisdomLab/.github#1327.
• All current inline review threads are resolved, but there is still no qualifying independent current-head non-author APPROVED review. Historical COMMENTED reviews and predecessor-head evidence do not transfer.

Lifecycle / merge discipline

This PR is not merge-ready and remains Draft. Do not mark Ready or merge until the unchanged exact head has terminal passing evidence for every applicable Orgmetra and central required gate, authoritative exact-head OpenCode/Noema/Strix outcomes, resolved required conversations, and qualifying independent non-author approval.

Do not self-approve, use routine administrator bypass, transfer predecessor evidence, weaken a gate, create a no-op retrigger commit, or create an Orgmetra workaround for a foreign dedicated-writer boundary.

Scope / non-claims

This packet is review evidence only. It does not itself authorize or persist an assignment change, prove Position capacity or legal/policy permissibility, copy sensitive worker/compensation/allocation values, or claim certification, deployed production integrations, or commercial release.

[coderabbitai]

📝 Walkthrough

Walkthrough

Assignment 변경 전 검토 패킷을 추가했습니다. 패킷은 불투명 참조와 SHA-256 다이제스트를 사용하며, PII와 변경 실행 권한을 포함하지 않습니다. 검증된 빌더, 테스트, 문서 및 전용 CI 워크플로를 추가했습니다.

Changes

Assignment Change Review

Layer / File(s)	Summary
거버넌스 계약과 패키지 구성 docs/adr/..., docs/doctoring/..., docs/traceability/..., packages/assignment-change-review/README.md, CHANGELOG.md, pyproject.toml	패킷의 참조 기반 범위, 민감 데이터 제외, 인간 검토, mutation 금지 상태와 운영 한계를 문서화했습니다. Python 패키지와 테스트 설정을 추가했습니다.
패킷 데이터 모델과 공개 API packages/assignment-change-review/src/orgmetra_assignment_change_review/packet.py, __init__.py	불변 AssignmentChangeReviewPacket과 build_assignment_change_review_packet를 추가했습니다. 고정된 거버넌스 상태와 공개 심볼을 정의했습니다.
검증·생성·결정론적 직렬화 packages/assignment-change-review/src/orgmetra_assignment_change_review/packet.py	UUID, 네임스페이스 참조, SHA-256 다이제스트, 날짜, 시간대, 사유 코드와 행위자를 검증합니다. canonical JSON과 SHA-256 다이제스트를 생성합니다.
테스트와 CI 품질 검증 packages/assignment-change-review/tests/test_packet.py, .github/workflows/assignment-change-review-quality.yml	유효성, fail-closed 제약, 행위자 분리, UTC 정규화, 직렬화 결정성을 검증합니다. 컴파일, 테스트, 100% 문장·브랜치 커버리지와 작업 트리 상태를 확인합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 60613

The packet could allow approval records to combine valid references from the wrong tenant or worker scope, risking incorrect assignment-review decisions; its supporting verification record is also future-dated to August 19, 2026. Merge should wait for these bounded correctness and governance issues to be corrected or explicitly accepted.

Sequence Diagram(s)

sequenceDiagram
  participant Host
  participant build_assignment_change_review_packet
  participant AssignmentChangeReviewPacket
  Host->>build_assignment_change_review_packet: 검토 입력 전달
  build_assignment_change_review_packet->>AssignmentChangeReviewPacket: 검증된 패킷 생성
  AssignmentChangeReviewPacket-->>Host: 불변 패킷 반환
  Host->>AssignmentChangeReviewPacket: canonical_json 및 sha256_digest 호출
  AssignmentChangeReviewPacket-->>Host: 결정론적 JSON과 SHA-256 반환

Loading

Possibly related PRs

• ContextualWisdomLab/Orgmetra#8: HRIS assignment 및 evidence 모델과 SHA-256 거버넌스 계약을 기반으로 합니다.
• ContextualWisdomLab/Orgmetra#39: 불변 검토 패킷, 빌더, canonical JSON, SHA-256 및 품질 워크플로 구조가 유사합니다.
• ContextualWisdomLab/Orgmetra#31: 이 패킷이 선행하는 People mutation 경계와 직접 연결됩니다.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 거버넌스가 적용된 AssignmentChangeReviewPacket 추가를 정확히 설명하며, PR의 주요 변경 사항과 일치합니다.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/governed-assignment-change-review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please independently review exact current head 606134b752cc86b25354ae0d3b865ad70c7a092e against protected develop f815feedcb0bac264d9814b2932338c512276110. Re-read the current diff and verify the assignment-change review packet's UUID-backed opaque references, allocation-policy binding, controlled non-sensitive reason categories, fail-closed scope/mutation states, PII/value minimization, deterministic SHA-256 evidence, and direct-construction/replace regressions. Repository-local Assignment Change Review Quality 32195978817, Foundation CI 32195978885, Security Scan 32195978753, and SAST Semgrep 32195979005 are terminal GREEN on this exact head; submitted reviews and inline threads are currently empty. If the unchanged head satisfies the repository review standard, submit a qualifying independent APPROVE review; otherwise leave only precise source-backed actionable findings. Do not modify the branch, reuse predecessor evidence, weaken gates, or rely on seonghobae approval.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Fresh central-owner status: .github#1353 (fix(strix): scope direct OpenAI tool fallback effort) merged on 2026-08-26 at merge commit 874f47b3856ca6bdb6bc71d48173b8f34ba7b9ca. This does not make Orgmetra #45 passing: its unchanged exact head 90aa2284a43b5f2491ee3f20c6946c4a78520c36 still needs a newly materialized Strix run using the current trusted central workflow and an authoritative report with no provider-failure markers. Do not treat an old-attempt rerun that reuses the predecessor trusted workflow source as the canary. Orgmetra-local gates remain GREEN; no leaf workaround or central-repository mutation is appropriate from this lane.

[seonghobae]

Fresh exact-head security-evidence correction; branch/lifecycle unchanged.

Current head remains 90aa2284a43b5f2491ee3f20c6946c4a78520c36 over develop@9e3e4847510e1e612b48474ba42b177b8ed824df. The existing PR body describes an older Strix provider-chain canary and is now superseded by the latest rerun evidence below.

Required Strix run 33010253596, latest attempt job 98804653800, is terminal FAILURE. Trusted central source .github@cdde0d82602d9568128fd0c1e985ea40b2292710 successfully resolved/materialized the exact target, passed the required-workflow smoke test, obtained target-read app credentials, installed pinned Strix, and started the pinned contextual-orchestrator sidecar (889b24f8547d059d1bf2b2f9a043aff15c9ea59d) healthy on loopback with all configured provider secrets present.

The current first failing boundary is therefore later and narrower: the actual orchestrator/free call returned HTTP 500 internal_error / LLM CONNECTION FAILED on all three bounded attempts (request IDs 4d1aafa47ced44dc88d847f9d395331d, 86c106ea5d5c4721a57b734723cdc621, 64f62e641bf9468793a4bcd61d911a5c). No authoritative structured vulnerability report was produced; the required gate correctly remains fail-closed as STRIX_PROVIDER_UNAVAILABLE. Diagnostic artifact 9680520101, SHA-256 9e42b5a563db46594034df67f9abda3f46f44d76906b0221c3e6fbec31c1c710, is non-passing diagnostic evidence only.

The exact causal evidence and unchanged-head GREEN acceptance were advanced through existing foreign owner path .github#1327. There is no Orgmetra-local source workaround that would repair this without weakening/duplicating the central scanner-orchestrator contract. Keep this Draft/unmerged; do not transfer local GREEN into central security evidence.